diff --git a/Usage.md b/Usage.md
index e05e0d9..661cb29 100644
--- a/Usage.md
+++ b/Usage.md
@@ -1114,7 +1114,7 @@ Besides classic SQL injection, sqlmap can also detect and exploit several other
 * `--xpath`: XPath injection
 * `--ssti`: server-side template injection
 
-Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, `--ssti-query` evaluates a single expression and `--ssti-shell` opens an interactive expression shell, while `--os-cmd` and `--os-shell` run operating system commands through the template engine where it allows it. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`).
+Each of these techniques is self-contained: it confirms the injection and extracts what that particular vector can reach, so the SQL enumeration options (e.g. `--banner`, `--dbs`, `--tables` and `--dump`) do not apply and are ignored. For server-side template injection, where the engine allows it, `--os-cmd` and `--os-shell` run operating system commands through the template engine. As with SQL injection, these techniques honor `--level` (for instance, `Cookie` parameters are only tested from `--level 2`).
 
 ### Seconds to delay the DBMS response for time-based blind SQL injection