Do SQL injection attacks always use a ' character?

Correct! ' isn't the only method. There are many characters like -- that you could use to exploit input.

Whoops! ' isn't the only method. There are many characters like -- that you could use to exploit input.