How is SQL injection possible using Bind variables?

Question

How is SQL injection possible when using bind variables?

My database administrator says that using bind variables does not completely protect one from SQL injection, but I can’t figure out how it could be, since bind variables, especially for strings, usually force the entered SQL to be a string in WHERE.

Example:

SELECT CUST_ID  
FROM CUST.CUSTOMER 
WHERE FIRST_NAME=:FNAME;

If FNAME="SELECT FNMAME WHERE CUST_ID=10040", in the database the following query will be launched

SELECT CUST_ID 
FROM CUST.CUSTOMER 
WHERE FIRST_NAME="SELECT FNMAME WHERE CUST_ID=10040";

which will return 0 rows.

I browsed the Internet to answer this question and even on this site, but I could not find it.

Thanks again.

Answer 1

, SQL- . BV SQL-.

 'select' + column_list + ' from T where col :1'

, , .

Answer 2

"" SQL- . , . , , ( ?).

:

SELECT CUST_ID FROM CUST.CUSTOMER ORDER BY :COLUMNNAME :DIRECTION

., , , , , .

. SQL, , , SQL, ASC/DESC . , , .

, , ?

!

, , SQL , . , .

, " ", , , SQL, , .

SQL Injection Myths and Fallacies. -: https://www.youtube.com/watch?v=VldxqTejybk

Answer 3

, SQL- , , . , SQL, SQL-.

SQL, . SQL , . , : . SQL, : .

Answer 4

, Mysql/PDO, Oracle.

, , , .

, , - - , , .

Answer 5

, , :

• ,
• DBA insert
• execute immediate

... or basically any other code that involves using dynamic SQL with a query string made up of user-supplied data. Even snap options will not help you.