SQL injection occurs when application input is inserted into SQL source code instead of being passed separately as a bound parameter. The exact position occupied by the input is its injection context. A quoted string, numeric expression, Boolean predicate, sort expression, and clause fragment each accept different SQL grammar, so a payload valid in one context may be invalid in another.

Blind SQL injection still causes the database to evaluate the injected SQL, but the selected value is not returned directly in the response. An oracle converts an indirect result into True or False: a Boolean oracle reads a repeatable response difference, while a time-based oracle reads whether the database deliberately delayed the response. Extraction then asks a sequence of Boolean questions: first the number of rows, then the length of one value, then each character in that value.

Database structure and function names differ by dialect. A server may contain databases or catalogs, each database may contain schemas, and each schema contains tables, columns, and rows. MySQL commonly treats database and schema as equivalent names, PostgreSQL and H2 use schemas inside a database, and SQLite exposes the main file and any attached files as databases.