In our SQL Injection Tutorial, we discussed how hackers use error messages from the database that they are trying to attack in order to determine whether or not that database is vulnerable to a SQL injection attack. But, what if database error messages are suppressed so that they are not displayed on the web page of a site that is under attack? Do hackers have some other way of running a SQL injection attack?
It turns out that hackers do actually have a way to run a SQL injection attack even when database error messages are disabled. This form of SQL injection is known as blind SQL injection.