Are strings like
AND '1' = '2 and
<script>alert('xss')</script> used to identify SQL injection and XSS vulnerability exploits?
If so, when black-box testing a house made web application, is the difference between vulnerability identification and exploitation the pentester's intent? For instance for SQL injections, in the first case the pentester wants to identify the vulnerability, and in the second case he/she wants to retrieve the records in the database?