Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with
diff) and that's it. However, detecting an infection in a database does not seem so easy. Comparing databases is probably way too complicated in most cases, because of the large amount of data that is constantly changing: tables with logs, options, posts, etc. So I thought that maybe the only reasonable solution is to actually check the data in the database and see if there's anything unexpected. But apart from a couple of obvious things, I'm not sure what to look for and how to look for it. The obvious things are those related to accounts and permissions, so for example I know I should definitely check for any users with unexpected high permissions, and that's normally easy to do. But how about... stored XSS? Should I look for strings like "script" or "onload", etc.? What else should I look for and how should I do it?
I know all this is highly dependent on the specific details of the web application (what it stores in the database and how it uses it), however I'm just looking for general advice. Note that I'm not asking how to recover from an infection: I'm just asking how to detect it, supposing it's restricted to the database. Also, by "infection" I mean anything that can lead to unauthorized access.