[joncrane]

Shouldn't it be

"); DROP TABLE Employees;--

?

[marcosdumay]

Nope. SQL uses single quotes for delimiting values, not double quotes.

[narrowingorbits]

But that would be SQL injection! Unlike the parent. Barbaric.