The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Injecting into Different Statement Types

The SQL language contains a number of verbs that may appear at the begin-

ning of statements. Because it is the most commonly used verb, the majority of

SQL injection vulnerabilities arise within 

SELECT

statements. Indeed, discus-

sions about SQL injection often give the impression that the vulnerability only

occurs in connection with 

SELECT

statements, because the examples used are

all of this type. However, SQL injection flaws can exist within any type of state-

ment, and there are some important considerations that you need to be aware

of in relation to each.