Binding variables errors

Running the following query on MySQL:

select COMMAND
from information_schema.PROCESSLIST
where COMMAND = :appo
;

with the binding variable appo set as Sleep

I get this error output:

Errore SQL [1054] [42S22]: Unknown column 'Sleep' in 'where clause'
  com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown column 'Sleep' in 'where clause'

if I run the same query without the where clause i get:

COMMAND |
--------|
Query   |
Sleep   |
Sleep   |

This issue was not present in DBeaver 3.7.7

Another (probably related, that’s why I’m adding it here) issue on Oracle about binding is the following; running the query

select * 
from dual
WHERE dummy = :appo
;

with appo set as X

I get the error:

Errore SQL [904] [42000]: ORA-00904: "X": identificativo non valido
java.sql.SQLSyntaxErrorException: ORA-00904: "X": identificativo non valido

which is Italian for invalid identifier.

running it without the where clause I obviously get:

DUMMY |
------|
X     |

Both query work as expected in SQLDeveloper 4.1.3.20

DBeaver version 3.8.0

[serge-rider]

It’d be a very bad idea to give access to DBeaver SQL editor to untrusted user. You can execute any SQL there, it doesn’t make any sense to use SQL injections to harm database - you can do this by simply executing harmful queries.

Agreed about single quote chars you need to use for strings. This is the price we had to pay. Potentially I could quote all “string-like” parameters but this won’t let to use expressions.

[dariopnc]

Yes, it is SQL injection. And there is no switch (for now). What problems do you see in this approach?

With the usual behavior of binding you could provide access to a DB with DBeaver even to untrained/untrusted users with specific queries, while keeping safety. Also, having to type apostrophes for every string remarkably slows down the workflow