If you are documenting this for a bug bounty program or an internal IT audit, here is how you would structure the report:
: This combines the results of the original query with a new set of data defined by the attacker. If you are documenting this for a bug
: This comments out the rest of the legitimate SQL query so it doesn't cause a syntax error. Part 2: Security Vulnerability Report Template If you are documenting this for a bug