Testing for Vulnerabilities Thoroughly checking a web application for SQL Injection vulnerabilities takes more effort than one might guess. It’s nice when a single quote inserted into the first argument of a script caused the server to return a nice blank, white screen with nothing but an ODBC error on it, but such is not always the case. It is very easy to overlook a perfectly vulnerable script if you don’t pay attention to details. Every parameter of every script on the server should be checked. Developers and development teams can be awfully inconsistent. The programmer who designed Script A might have had nothing to do with the development of Script B, so where one might be immune to SQL Injection, the other might be ripe for abuse. In fact, the programmer who worked on Function A in Script A might have nothing to do with Function B in Script A, so while one parameter in one script might be vulnerable, another might not.