Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Let's imagine a website which allows users to Sign up and login only with their email address.
Is it possible to perform a second order SQL injection in that case?
It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it.
So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.
Required, but never shown