To check for SQL injection vulnerabilities in your application, begin by performing a manual code review of the sections where user inputs are handled, particularly those that interact with the database. Look for instances where SQL queries are constructed using user inputs without proper sanitation. Identify the use of functions like `mysqli_query()` or `PDO::query()` that directly incorporate user data into SQL statements. A lack of prepared statements is a significant indicator of potential vulnerabilities. Additionally, focus on the presence and utilization of sanitization functions or libraries like `htmlspecialchars()`, `filter_var()` for validation, and consider whether there are any ORM (Object-Relational Mapping) implementations that abstract away SQL queries.

Next, conduct penetration testing by crafting synthetic user input designed to expose vulnerabilities. Start with basic payloads like a single quote (`’`) or SQL comments (`–`) and progressively test more complex inputs that could manipulate the SQL logic—such as union-based attacks or time-based blind injections. Utilize tools such as SQLMap for automated scanning of your application, but ensure you manually validate the findings by performing targeted tests. Additionally, monitor the application’s behavior and database responses during your testing to identify unexpected outputs, query errors, or discrepancies in the data returned, as these can be telltale signs of SQL injection susceptibility. Always maintain ethical standards and conduct testing in a controlled environment to avoid any unauthorized data access.