反sql注入功能

Question

I am using this function to prevent sql injections :

function filter($input)
{
  if(strpos(str_replace("''","","$input"),"'") != false)
  {
    return str_replace("'", "''", $input);
  }
  return $input;
}

is it safe to use it? can someone somehow bypass it? if is is possible to bypass it please give me a hint on how to secure this function or an example on how you see bypass for it

UPDATE : it is used on SQL Server

Answer 1

is it safe to use it?

NO

can someone somehow bypass it?

YES

1. It shouldn't be input filter by any means. But data formatter for the SQL query.

2. At the very least it have to be

   function SQLstrFormat($str)
   {
       return "'".str_replace("'", "''", $str)."'";
   }
   

this way it would be safe, when applicable.