Is it damage if you're just sending data to an endpoint to see what happens. Sounds like he didn't try to send a SQL Injection, he just sent more characters than what was expected.