You can do SQLi against your own database 24x7 and you'd be just fine in the eyes of the law.