What is the minimum input length required for sql injection? Perhaps this belongs on the 'golf code' stack or elsewhere, if so, apologies and I'll remove it.

I have been working on a older application and re-writing SQL statements as postgres functions to help avoid exposure to SQL injection. I got to thinking, that if something was in the form of 

SELECT * FROM Whatever WHERE id = user_input_here

then what would be the shortest user_input_here that could allow Bobby Tables or one of his friends to do their dirty work? If the user_input string had already been constrained to a very few characters, presumably no mischief could be done. (Perhaps we know the 'id' is always exactly 6 characters.) Presumably you'd want at least one dummy character for the original query, then a semicolon before your injected code, what could be the shortest valid statement after that?

Understand that I am not advocating this as a protection method, I'm just curious.
Probably one of the shortest injections are used by sqlmap, for example: "union select version();" (note the leading space).

I can't think of anything shorter than ';call boom()-- - which exploits multiple-query feature of LibPQ, and - obviously - requires top-secret application-specific knowledge.

This code is exploitable:

import sys
import psycopg2
conn = psycopg2.connect(dsn='')
cur = conn.cursor()
sql = "SELECT reltuples, relpages FROM pg_class WHERE relname = '{}'".format(sys.argv[1])
cur.execute(sql)
for row in cur:
    print(row)


Exploited:

$ python exploitable.py pg_class
(342.0, 12)
$ python exploitable.py "';call boom()--"
Traceback (most recent call last):
  File "exploitable.py", line 6, in &lt;module&gt;
    cur.execute(sql)
psycopg2.InternalError: Boom!
CONTEXT:  PL/pgSQL function boom() line 1 at RAISE