=> SELECT * from page where id = 1 or 1=1. In your example the attacker would use spaces: Imagine that you had a url which used user supplied input unsafely in a query: Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input.

Note: I'm asking this question purely out of curiosity, not as way to circumvent using the 'proper' methods of SQL Injection Prevention. I'm curious if there is any form of SQL injection that could defeat this? Are there one word dangerous commands? If this can be defeated, would removing spaces at least help a bit with defense? However if you took that search string update aTable set someColumn='JackedUpValue' where someColumn likeĪnd performed the operation shown in this question, wouldn't you get updateaTablesetsomeColumn='JackedUpValue'wheresomeColumnlike Then when you put it all together and execute it dynamically you would get Select * from aTable where name like '%' update aTable set someColumn='JackedUpValue' where someColumn like '%' Select * from aTable where name like you held something like '' update aTable set someColumn='JackedUpValue' where someColumn like ' trim only removes space on the outside of your string. No, adding a trim will not prevent sql injection. I was looking at this question, which asks about trim, and the top answer says this: I have been reading up on SQL Injection at OWASP, but they don't mention anything about removing spaces, so I was curious why it would, or would not work? I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input?

Url encode for white space