Are sql injections legal?

Essentially, if you are seen to be someone who knows what you are doing, then even typing in a single-quote to a web form has been enough to be arrested and charged over in the past.

But lets say i'm writing a pen test tool that will be doing sqli testing and let it loose on sites that are 'out in the wild'. I'm not going to be doing dumps of any information. But is just the vulnerability scan itself illegal?