I recently called some website's tech support because their web form was giving error 500. They said I need to make sure there were no single quotes in the form

I recently called some website's tech support because their web form was giving error 500. They said I need to make sure there were no single quotes in the form. Horrifying enough, removing the single quote fixed it. So they've either got SQL injection or something even worse.