I want the user to be able to provide a custom WHERE statement against a mysql-backed platform... do I need to worry about any possible SQL injection attacks notwithstanding invalid sql? See the pseudo code below.
return sqlExec("select a,b,c from mytable where %s", args)
Okay, in all seriousness I can see where this can go horribly wrong.
But given that multiStatements is disabled, what is the most elegant way I can prevent from undesired injections from happening? Would it only be limited to preventing
SELECT...INTO? Or would it just be making sure that "%s" is indeed a valid where_condition. Or am I missing something entirely?
If they want to run arbitrary SQL they've got to write it themselves. I'm sick of making "query builders".