Which of the following characters will you use to check whether an application is vulnerable to an SQL injection attack?

The single quote (') is the most fundamental and universally effective character for initially testing for SQL injection vulnerabilities. In standard SQL, string literals are enclosed in single quotes. By submitting a single quote as input, a tester attempts to prematurely terminate a string in the backend query. If the application fails to sanitize this input, the database will interpret the unterminated string, resulting in a syntax error. This error response from the application is a strong indicator that it is vulnerable to SQL injection.

B. Semi colon (;): This character is used to terminate an SQL statement and is primarily used for exploitation (e.g., stacked queries), not initial detection.
C. Double quote ("): While used as a string or identifier delimiter in some specific database configurations, the single quote is the far more common standard, making it the primary test character.
D. Dash (-): A single dash has no special meaning. A double dash (--) is a comment operator used during exploitation to nullify the remainder of the original query, not for initial probing.

1. OWASP Foundation. (2021). OWASP Web Security Testing Guide (WSTG)

Version 4.2. In section "4.8.3 Testing for SQL Injection (OTG-INPVAL-005)

" the guide states

"The most basic and classic way to test for SQL injection is to use the single quote character (') and to look for errors." (p. 289).

2. Microsoft. (2023). SQL Injection. Microsoft Learn. In the section "How to test for SQL injection

" the documentation advises

"The classic test for SQL injection is to enter a single quote (') into a text box on a web page and check to see if an error is returned."

3. Boneh

D. (2018). CS 155: Computer and Network Security

Lecture 4: Web Security: SQL Injection

XSS. Stanford University. Slide 10 demonstrates the canonical SQL injection attack (' or 1=1 --)

which fundamentally relies on the initial single quote to break out of the intended string context of the SQL query.