A little question about Sql Injection in SP.

[Ming Yeung]

Hi,

I just had some tests with sql injection.

Here are two different statements in the stored procedures do the same work, where inUsername and inPassword are IN parameters:

1st:
SELECT * FROM user WHERE username = inUsername AND password = inPassword;

2nd:
SET @sql = CONCAT("SELECT * FROM users WHERE username ='", inUsername, "' AND password='", inPassword, "'");

PREPARE STMT FROM @Sql;
EXECUTE STMT;

If users input: ' OR username='abc' -- for the username. The 2nd statement will occur a sql injection while 1st statement will not.

My question is ... what are the differences between them? Why the 1st statement does not need single quotes ?

Regards,
Ming