---
name: validate-sql-injection
description: Evidence bar and severity basis for SQL injection, in-band and blind. Use when validating a finding that claims attacker-controlled database queries.
---

# Validate SQL injection

- Require a result the database controls, not application-generated text: a value read from it, or for blind injection the response time tracking the injected sleep value across two different values, or a true and a false condition giving different results. One delay or one unexplained response difference is not enough.
- Describe database identity, query capabilities and privileges only where the evidence supports them; do not require an inventory of unrelated capabilities or downstream execution paths.
- Base severity on reachable data and privileges, not the SQL injection primitive alone. Treat schema names as impact indicators; claim disclosure of PII or credentials only when evidence establishes that the vulnerable execution context can read the relevant objects.