Are they vulnerable though, if they already exclude it at the user input?

I yet have to learn SQL and is there a way to allow passwords with '); DROP TABLE… without being vulnerable to an injection?

nevermind i googled it, and there various ways to do so