A tester has been hired to do a web application security test. The tester notices that the site is dynamic and must make use of a back end database. In order for the tester to see if SQL injection is

A semicolon is used in SQL injection to chain additional statements, but it is not the first character used to test for vulnerability - it presupposes injection is already possible.

A single quote (') is used to attempt to break out of the string context in a SQL statement, which can cause a syntax error or expose underlying query structure if the input is not properly sanitized. If the application returns a database error after submitting a single quote, it confirms that raw input is being interpolated into the SQL query. This is the standard first probe in manual SQL injection testing because it directly tests string delimiter handling.

An exclamation mark has no special meaning in standard SQL syntax and would not break a query or reveal injection points.

A double quote may be valid in some database dialects but is not the universally recognized first probe character for SQL injection testing.