In blind Structured Query Language (SQL) injection, the attacker cannot directly see the result and instead infers information from application behavior.

### Why this is right Blind injection means the result is not directly displayed to the attacker. Information may instead be inferred from changes in the application's responses or behavior. ### The concept Injection types can be distinguished by how results are obtained. In-band attacks use the same communication channel to launch the attack and receive results. Out-of-band attacks use a different channel. Blind attacks rely on inference because direct results are unavailable. ### The other options - **False**: this is incorrect because inference from application behavior is the defining feature described for blind injection. ### Terms - **SQL**: Structured Query Language, used to query and manage relational databases. - **Blind injection**: an injection approach where results are inferred rather than directly displayed. - **In-band**: using the same channel to send the attack and receive results. - **Out-of-band**: using a different channel to send the attack and obtain results. ### Remember Blind means infer; it does not mean that no information can be obtained.