You are looking for SQL injection vulnerability by sending a special character to web applications. Which of the following is the most useful for quick validation?

Double quotation marks are string delimiters only in certain databases (e.g., PostgreSQL in ANSI mode) and are far less universally effective as a quick probe.

Backslash is an escape character in some databases but does not directly break SQL string parsing syntax in a way that reliably triggers injection errors.

Semicolons are used to terminate and chain SQL statements (stacked queries) but do not by themselves break string context or produce the immediate syntax errors useful for quick detection.

SQL parsers treat a single quote as the string delimiter, so injecting one into an unsanitized input breaks the query syntax and typically returns a database error (e.g., 'You have an error in your SQL syntax'). This immediate, observable error response makes it the fastest and most universal first indicator of SQL injection susceptibility across virtually all SQL database engines.