# Dynamic Statements And Sql Injections

__*SQL Injection*__

+ So far we've been dealing with dynamic statements
+ The SQL statements we build are all string, and the TiDB server instance compiles the strings into executable SQL statements
+ Most of the time in an application you don't want to offer so much flexibility
+ For example, when you design a statement that accepts variables:
  + `DELETE FROM test.r1 WHERE name = '?'`  
  + And what the user enters is `x' or 'x'='x` : 

```8
tidb> DELETE FROM test.r1 WHERE ~!@name = 'x' or 'x'='x'@!~;
Query OK, ~!@16384@!~ rows affected (0.35 sec)

tidb> SELECT count(*) FROM test.r1;
+----------+
| count(*) |
+----------+
|        0 |
+----------+
1 row in set (0.01 sec)
```
------------------------------------------------------------

SQL injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution