SQL injection (SQLi) attacks attempt to inject SQL syntax into web requests, which may bypass authentication and allow attackers to access and/or modify data attached to a web application. Which of…

In-band SQLi retrieves data through the same communication channel used to inject the malicious SQL, such as error messages or query results returned directly in the HTTP response, not through DNS.

Union-based SQLi is a subtype of in-band SQLi that uses the UNION SQL operator to append a second SELECT query and return its results within the same HTTP response, not via an external DNS channel.

Out-of-band SQLi relies on the database server's ability to make outbound network requests - commonly DNS or HTTP - to transmit extracted data to an external attacker-controlled destination. This technique is used when the attacker cannot retrieve data directly through the web application's response channel. Functions like Oracle's UTL_HTTP or SQL Server's xp_dirtree can trigger DNS/HTTP requests that encode and exfiltrate data out-of-band.

Time-based blind SQLi infers data by measuring the database's response delay (e.g., using SLEEP() or WAITFOR DELAY), which does not involve DNS requests or any out-of-band communication channel.