Union-based injections Blind SQL injections If no out­put is giv­en from a state­ment, try to use time-based approaches. Enumerating in inserts Assum­ing the INSERT state­ment is INSERT INTO $tablename (email,name) VALUES ("email", "name"); Then try a tim­ing attack to deter­mine if a cer­tain val­ue is in a field: INSERT INTO newsletter (name,email) VALUES ('name', ' ' AND…