This doesn't make any sense... why wouldn't the attacker just do the attack themselves? What is the advantage to this?
You don't leave forensic evidence of the attack. You don't have automated IDS systems blacklist your IPs. You get a one-to-many leverage on the backs of Google's prodigious crawler farm. You potentially goad the target into manual or automatic decisions which penalize Google, thereby inducing Google to automatically retaliate with decisions which inflict business damage upon the target, which may be a goal of the attack. etc, etc.
you can block areas of your site accessible to bots with the robots.txt
> The only solution is to not be vulnerable to SQL injection attacks.
If this is your reason for fixing SQL injection vulnerabilities, you're doing something wrong.
's kinda ironic that Michael Zalewski now works for Google o_o