It also fails if the system was written using parameterized queries. I wouldn't expect a system to be sanitizing anything if fails to take the most basic step for db access. This whole discussion is only relevant for systems developed by amateurs. SQL injection can only work at all if you use string concatenation to create queries, which you should never do.

Injections don't always need ''. The statements

  1=1

and

  1=0

if injected into a query will give different answers if SQLI exists.

There are MANY other tricks that don't involve '

'.

Besides, consider the number of valid queries done by the application that involve '*'. You are not going to turn that off.

Sanitization almost always fails. This becomes an arms race.

There are trivial ways around all of those. `LIMIT 1`, `SELECT .. FROM information_schema...`, etc.

Such as...