SQL 125 🛢️ Dynamic SQL and SQL Injection Hazards in Procedural Code
Dynamic SQL is the construction of a SQL statement as a string at runtime, then executing it. It exists because some parts of a query cannot be parameterized: table names, column names, sort directions, and identifiers that the query planner needs to see as structure rather than data. The hazard is that the same mechanism…