Re: no more PREPARE and EXECUTE statement in stored procedure

[Pilon Mntry]

:)
This is funny. I was trying to write a vulnerable stored procedure in mysql (as in mssql) and thought it's not possible to write one ... until I read these messages.
In mssql a vulnerable sp might look like:
CREATE PROCEDURE dbo.StoredProcedure1(@username nchar(10))
AS
declare @myquery nchar(128)
select @myquery = 'select * from sessionlog where username = ''' + @username + ''''
exec @myquery
RETURN

and now I've learned in mysql same sp can look alike with a few changes

PREPARE stm_str_sql FROM @str_sql;
EXECUTE stm_str_sql;

But sure, this is avery beneficial feature when used securely.