# Dynamic Statements and SQL Injections

__*SQL Injection*__

+ So far we have been dealing with dynamic statements
+ The SQL statements we build are all string, and the `TiDB` server instance compiles the strings into executable `SQL` statements
+ Most of the time in an application you don't want to offer so much flexibility
+ For example, when you design a statement that accepts variables:
  + **`DELETE FROM test.r1 WHERE name = '?'`**
  + And what the user enters is **_`x' or 'x'='x`_**

```
tidb> DELETE FROM test.r1 WHERE ~!@name = 'x' or 'x'='x'@!~;
Query OK, ~!@16384@!~ rows affected (0.35 sec)

tidb> SELECT count(*) FROM test.r1;
+----------+
| count(*) |
+----------+
|        ~!@0@!~ |
+----------+
1 row in set (0.01 sec)
```
------------------------------------------------------------

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution