Database enumeration through SQL injection often involves injecting queries that output metadata about the database, such as table names or column names. Attackers can use error-based techniques to prompt detailed error messages that reveal internal database structure or leverage UNION-based injections to concatenate text fetched from database schema tables. Through enumeration, attackers can map out the entire database structure, aiding in the efficient extraction of sensitive data .

Securing a database against SQL injection attacks involves several methods including using prepared statements with parameterized queries to ensure safe execution of SQL commands, employing stored procedures to abstract direct SQL execution and provide restricted interfaces, validating and sanitizing all user inputs, and utilizing web application firewalls (WAFs) to detect and block malicious traffic. Additionally, regular security audits and updates can help identify and mitigate vulnerabilities before they're exploited .

Exploitation of XML External Entities (XXE) in SQL-based applications occurs when unsanitized XML input containing a directive causes the server to access resources from an external server, potentially disclosing sensitive files or executing remote code. For example, an attacker can use DOCTYPE declarations to include system identifiers like file paths or URLs, resulting in arbitrary file retrieval or Denial of Service attacks. Impacts include data breaches, unauthorized access to confidential information, and partial to full system compromise .

Input validation involves restricting input types and values that can be passed to backend systems, ensuring that only expected and safe data is processed. Sanitization further involves cleaning input to remove or escape characters that might be interpreted as SQL commands or data. This prevents attackers from injecting harmful SQL statements through user inputs like login forms or search bars, thereby mitigating SQL injection vulnerabilities by ensuring that input does not alter query logic or syntax .

ORACLE_ENCODE_STRING is used to safely encode input strings in queries, reducing the risk of SQL injection by converting special characters into a format that cannot be executed as SQL commands. It is especially significant in environments using Oracle databases, as it helps prevent exploitation by ensuring that inputs are treated as strings rather than executable code, thus protecting against unauthorized data access or manipulation .

Unrestricted file access via functions like 'load_file' allows attackers to read server-side files, exposing sensitive information like configuration files and passwords. This can lead to unauthorized information disclosure, privilege escalation, and further network compromise as attackers gain insights into system and application configurations. The impact is significant as it could potentially allow adversaries full control over affected systems, introducing substantial security risks .

Attackers use comments, such as -- or /* */, in SQL queries to terminate legitimate parts of the query and append malicious payloads without causing syntax errors. This technique is effective in manipulating query logic and bypassing authentication checks. It allows attackers to discard unwanted portions of the code, facilitating the introduction of their injected queries unobtrusively, thereby enhancing the payload's execution success .

Common techniques in SQL injection attacks include the use of tautologies to bypass authentication (e.g., 'or 'a'='a), exploiting UNION operators to combine queries and extract data, manipulating statements to trigger time delays (e.g., 'or '1'='1' waitfor delay '0:0:20'), and using comments or stacking queries to inject commands. These techniques often involve appending malicious code to existing queries to alter their behavior .

Stored procedures are effective against SQL injection attacks by providing a controlled interface for query execution. They encapsulate SQL code within the database, reducing surface attacks by restricting direct access. However, their effectiveness hinges on proper implementation; if improperly coded or not parameterized, they may still be vulnerable. While they enhance security by abstracting SQL logic and minimizing user interference, they must be used in conjunction with other security measures such as input validation and regular security reviews for comprehensive protection .

Time-based blind SQL injections play a significant role in extracting data when error messages are not accessible, by introducing delays through database operations. For example, the 'waitfor delay' command is used to induce noticeable time delays. These injections determine the query's truth based on the time it takes to execute. Though not as quick as directly retrieving error messages or visible results, this technique is highly effective in controlled environments for extracting data without any direct feedback, making it one of the stealthiest methods .