SQL Execute Immediate

Switch to the procedure editor.

Replace the EXEC keyword with EXECUTE IMMEDIATE

1. Click “Save”.

Use what you have learned already and perform a build on your hdb module.

Return to the HRTT page run the call statement again.

You will notice the implicit result set is now returned to the console. But you still cannot work further on this result set.

Now change the CALL statement again, this time insert the value for the input parameter as ‘ ’ as shown here. Run the CALL statement again

You will notice the count is 10, which refers to all products except for Laser printers.

Now change the CALL statement. This time insert the value for the input parameter as ‘OR 1 = 1’ as shown here. Run the CALL statement again.

You will notice the count is now much higher, 106. This illustrates the possibility of SQL injection. The always true OR-condition (1=1) will enforce that the complete where-condition will be evaluated to true for each record.