From text box validation to prevent sql injection

Question

What are the special characters; I should not allow the user to enter in text box field for security reasons.

Answer 1

SQL Injection can more reliably be prevented by using prepared statements like the following. If you can't use this pattern, the second best method would be to "white list" the good characters instead of "black listing" the prohibited characters.

.NET

 String query = 
     "SELECT account_balance FROM user_data WHERE user_name = ?";
 try {
    OleDbCommand command = new OleDbCommand(query, connection);
    command.Parameters.Add(new OleDbParameter("custrName", CustName Name.Text));
    OleDbDataReader reader = command.ExecuteReader();
    // …
 } catch (OleDbException se) {
    // error handling
 } 

Java

 String custname = request.getParameter("customerName"); 
 String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";

 PreparedStatement pstmt = connection.prepareStatement( query );
 pstmt.setString( 1, custname); 
 ResultSet results = pstmt.executeQuery( );

You can consult OWASP SQL Injection Prevention Cheat Sheet for more examples of prepared statements and the OWASP Input Validation Cheat Sheet to learn more about white listing if you're absolutely set on white listing/black listing.

Answer 2

mysql_real_escape_string($string) (PHP) will do that job for you. You don't have to filter data.

Mostly the ' (single quote) and " (double quote) will give troubles without escapes.