SQLi exploitation types: Error-based (extract via error messages), Union-based (join additional SELECT), Boolean-based (infer data from true/false responses), Time-based blind (SLEEP() delays confirm injection).
sqlmap automates SQLi detection and exploitation. Manual: ' or 1=1-- in login fields. Union injection: ' UNION SELECT username,password FROM users-- . Always test with sqlmap --level=5 --risk=3 for comprehensive testing. SQLi can dump entire databases, bypass auth, and in some configs, achieve RCE via INTO OUTFILE or xp_cmdshell.