How to Test for SQL Injection in Microsoft Access
- 1). Open the program you've written to interface with your database.
- 2). Select any user input that will translate to a database call. This is usually any kind of input that will retrieve data.
- 3). Begin inputting arbitrary SQL. An example would be "; Drop database *." The semicolon acts to terminate any previous SQL statements. If any of it executes, your application is vulnerable to SQL injection.
Source...