SQL Injection is an application layer exploit that gains the attacker access to the database, but does not involve any sort of privilege escalation. Consider this: an attack gain access to your bank&#x27;s user credentials database. Do you want them to have access to your unencrypted password? Is it really so &quot;harmless&quot;?