I've some experiences of working with PHP web applications vulnerable to SQL injection and exploiting this type of vulnerability successfully but never tried to do this on a ASP based web application. When we try to find out if a PHP web application is vulnerable to SQL injection we usually add a single quote to the end of an input parameter like this:
and if we get an error like this:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
we know that it's vulnerable. In some cases we get a blank page or missing some data on page which can mean that its vulnerable.
So here is my question: If I add a single quote to the end of an input parameter in an classic ASP web page and I get a blank page or miss some data on that page, does it mean that it's vulnerable to SQL injection? And is there any other ways to know if an SQL injection vulnerability exists in an ASP web application?