title: How is SQL Injection Possible When Using Bind Variables?
body: <p>How is SQL injection possible when using bind variables?</p>
  
  <p>My DBA says that using bind variables doesn't fully secure one against SQL injection, but I can't find out how this can be the case, since bind variables especially for strings will usually force the injected SQL to be a string in a <code>WHERE</code> clause.</p>
  
  <p>Example:</p>
  
  <pre><code>SELECT CUST_ID  
  FROM CUST.CUSTOMER 
  WHERE FIRST_NAME=:FNAME;
  </code></pre>
  
  <p>If <code>FNAME="SELECT FNMAME WHERE CUST_ID=10040"</code>, the database will run the following query</p>
  
  <pre><code>SELECT CUST_ID 
  FROM CUST.CUSTOMER 
  WHERE FIRST_NAME="SELECT FNMAME WHERE CUST_ID=10040";
  </code></pre>
  
  <p>which will return 0 rows.</p>
  
  <p>I scoured the Internet for an answer to this question and even this site, but I couldn't find it.</p>
  
  <p>Thanks again.</p>