Which of the following characters will you use to check whether an application is vulnerable to an SQL injection attack?

A dash alone does not break SQL string literals and is not a recognized standard first-step test character for SQL injection vulnerability.

A double quote is used for identifier quoting in some SQL dialects but is not the universally recognized initial probe character for SQL injection testing.

Inserting a single quote into an input field attempts to prematurely close a SQL string literal, causing a syntax error if the input is not sanitized or parameterized. A database error response confirms that raw user input is being concatenated directly into a SQL query, which is the defining indicator of SQL injection vulnerability. It is the most widely recognized and standard first-step probe for SQL injection.

A semicolon can be used to stack SQL statements in certain databases but does not directly reveal injection vulnerability on its own and is not the standard initial test character.