title: Is it possible to inject sql to delete statement?
body: <p>i built website that uses sql server and have this sql for deleting items by id that im getting from querystring:</p>
  
  <pre><code>DELETE FROM tablename WHERE GUID = 'param'
  </code></pre>
  
  <p>is it possible to inject sql that will return db_name() for example?</p>
  
  <p>i know that i can inject sql only for <strong>select</strong> statements something like this</p>
  
  <pre><code>select name from tablename where 'parems' 
  union all
  select db_name()
  </code></pre>
  
  <p>but what about <strong>delete</strong> statements</p>
  
  <p>i know that i can drop table insert to table, but in this stage i need know if i can get kind of data, for ex.: db_name()</p>