What is the smallest possible character sequence for SQL injection attacks?

Question

Simple SQL injection attack with as few characters as possible. Please note: I am not trying to prevent SQL injection attacks by limiting data entry to a specific size, but I am really curious how many characters are required to perform even the simplest attack.

For posterity, let's say the smallest table name is 4 characters, for example, "user". Please rate this.

Answer 1

1 Character is the smallest unit you control over. The question is highly dependent on what you are doing. For example, if you are dealing with an interface for deleting your profile from the site, and you send '%' instead of your name:

"Delete from Users where name like '"+username+"'" 

then setting your username to % will delete all users.

Answer 2

When entering into a string literal:

 ';drop database;-- 

Answer 3

Suppose the request was generated as follows

 "Select * from user where userid = " + myVar 1; delete from user;