When launching a SQL Injection attack, what characters might an attacker start experimenting with first?

Single quotes (') are the most common starting point for SQL injection probing because SQL uses them as string delimiters. Inserting a single quote into an input field can break the SQL string context, causing a database error that confirms the parameter is vulnerable and unsanitized. This error-based discovery technique is a foundational step in manual SQL injection testing.

Alphabetic characters are treated as ordinary string data by SQL parsers and do not disrupt query syntax or reveal injection vulnerabilities.

Numeric characters are valid SQL literals and do not break query syntax unless used in specific arithmetic-based blind injection contexts, making them a secondary technique, not the first step.

Percent signs are wildcard characters in SQL LIKE clauses but do not break string delimiters or cause syntax errors used to identify injection points.