In this blogpost describing a pentest, the author adds
' to a field requiring some value, and concludes that there is an SQLi vulnerability:
Upon further investigation adding a single quote would make the server return a 500 status error, which.... SCREAMS SQLi
Does an HTTP 500 code mean it is vulnerable to SQLi? Or do all HTTP error codes mean it is an SQL injection? Which HTTP code do not mean an SQLi?