The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

any attack on the 

WHERE

clause may be replicated in these other statements,

potentially wreaking havoc within the profiles of all application users. You

should ensure that the application owner accepts these unavoidable risks

before attempting to probe for or exploit any SQL injection flaws, and you

should also strongly encourage them to perform a full database backup 

before you begin testing.

DELETE Statements

DELETE

statements are used to delete one or more rows of data within a table,

for example when users remove an item from their shopping basket or delete

a delivery address from their personal details.

As with 

UPDATE

statements, a 

WHERE

clause is normally used to tell the data-

base which rows of the table to update, and user-supplied data is most likely

to be incorporated into this clause. Subverting the intended 

WHERE

clause can

have far-reaching effects, and the same caution described for 

UPDATE

state-

ments applies to this attack.