Let's imagine a website which allows users to Sign up and login only with their email address.
Is it possible to perform a second order SQL injection in that case?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.
So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.