This question already has an answer here:
If a user is to fingerprint a server via SQL injection and doesn't want the server to be able to trace back. Is the only way to use a proxy/VPN?
Can queries and requests be sent through TOR network? Or would a user have to use multi-layer VPNs, bounces through different proxies before actual request?