A few notes
An SQL injection attack is when something unexpected is inserted into a database. The types of injections depend on the vulnerabilities of the system.
SQL Query Injection
If the database doesn't have proper permissions, meaning that the web user has full control over the database, then they can potentially do things like replace all records, drop tables, and add their own tables.
An example might be an injection on an edit where site is expecting the user to edit their own record, but instead they update all in the server.
\' or where 1=1;
If they have read-only access to the database they might escalate their privileges and pull out more info than they're supposed to. This example would be on a server that is returning two records, the user then adds the user's table as their result.
\' UNION ALL SELECT username,password from USERS;
Many of the features of the latest versions of PHP have been hardened to fix issues with code execution however some developers use things like
exec() to perform actions on code pulled from a database. Some older versions of PHP are still vulnerable to attack.
Developers are the front line for defense when it comes to writing a website. Let's say you have a corporate CMS and the developers created a user-editable table in the CMS for modifying something like display ads.
The attacker could enter
phpinfo(); and see all of the database about the server, or execute command line codes (depending on the access of the website user account on the web server), or add their own backdoor to the site (write or rewrite files). This could allow the user to redirect all traffic off of the site entirely.
The legal ramifications for testing on someone else's box are different depending on the country you're in and the country the server is being hosted in. With that being said, there are a lot of free versions of operating systems like FreeBSD and various types of Linux (some more secure than others) where you can install an OS, a web server, and a MySQL server on a Virtual Machine under something like Virtual Box and go to town without hosing your production machine.
Some of the other answers given by other posters are excellent in this thread as well.