A few notes
An SQL injection attack is when something unexpected is inserted into a database. The types of injections depend on the vulnerabilities of the system.
SQL Query Injection
If the database doesn't have proper permissions, meaning that the web user has full control over the database, then they can potentially do things like replace all records, drop tables, and add their own tables.
An example might be an injection on an edit where site is expecting the user to edit their own record, but instead they update all in the server.
\' or where 1=1;
If they have read-only access to the database they might escalate their privileges and pull out more info than they're supposed to. This example would be on a server that is returning two records, the user then adds the user's table as their result.
\' UNION ALL SELECT username,password from USERS;
PHP injection
Many of the features of the latest versions of PHP have been hardened to fix issues with code execution however some developers use things like exec()
to perform actions on code pulled from a database. Some older versions of PHP are still vulnerable to attack.
Developers are the front line for defense when it comes to writing a website. Let's say you have a corporate CMS and the developers created a user-editable table in the CMS for modifying something like display ads.
The attacker could enter phpinfo();
and see all of the database about the server, or execute command line codes (depending on the access of the website user account on the web server), or add their own backdoor to the site (write or rewrite files). This could allow the user to redirect all traffic off of the site entirely.
Script injection
While the site's PHP may be less vulnerable to an attack, a user may still inject things such as iframes containing malicious code, javascripts containing malicious code, or JAVA applets that allow them to steal user cookies. Since javascript can execute AJAX and send requests to a different webserver unannounced this would likely not be seen in the interface even though it could happen.
<script type='text/javascript'>
window.location('http://someotherwebsite.com');
</script>
Testing
The legal ramifications for testing on someone else's box are different depending on the country you're in and the country the server is being hosted in. With that being said, there are a lot of free versions of operating systems like FreeBSD and various types of Linux (some more secure than others) where you can install an OS, a web server, and a MySQL server on a Virtual Machine under something like Virtual Box and go to town without hosing your production machine.
Some of the other answers given by other posters are excellent in this thread as well.