CREATE TABLE employees AS SELECT * FROM hr.employees

CREATE OR REPLACE PACKAGE sql_injection_demo 
IS 
   TYPE name_sal_rt IS RECORD ( 
      last_name   VARCHAR2(1000)
    , salary      NUMBER
   ); 
 
   FUNCTION name_sal_for (where_in IN VARCHAR2 DEFAULT NULL) 
      RETURN sys_refcursor; 
 
   PROCEDURE show_name_sal ( 
      title_in IN VARCHAR2 
    , rows_inout IN OUT sys_refcursor 
   ); 
END sql_injection_demo; 

Danger! Danger! Danger!

CREATE OR REPLACE PACKAGE BODY sql_injection_demo 
IS 
   FUNCTION name_sal_for (where_in IN VARCHAR2 DEFAULT NULL) 
      RETURN sys_refcursor 
   IS 
      l_query   VARCHAR2 (32767) 
              := 'select last_name, salary from employees WHERE ' || where_in; 
      l_cursor        sys_refcursor; 
   BEGIN 
      OPEN l_cursor FOR l_query; 
 
      RETURN l_cursor; 
   END name_sal_for; 
 
   PROCEDURE show_name_sal ( 
      title_in IN VARCHAR2 
    , rows_inout IN OUT sys_refcursor 
   ) 
   IS 
      l_employee   name_sal_rt; 
   BEGIN 
      DBMS_OUTPUT.put_line (RPAD ('=', 100, '=')); 
      DBMS_OUTPUT.put_line ('SQL Injection Demonstration: ' || title_in); 
 
      LOOP 
         FETCH rows_inout 
          INTO l_employee; 
         EXIT WHEN rows_inout%NOTFOUND; 
 
         DBMS_OUTPUT.put_line (l_employee.last_name || '-' 
                               || l_employee.salary 
                              ); 
      END LOOP; 
 
      CLOSE rows_inout; 
   END show_name_sal; 
END sql_injection_demo; 

That's a Funny WHERE Clause!

DECLARE 
   l_rows   sys_refcursor; 
BEGIN 
   l_rows := sql_injection_demo.name_sal_for ('department_id = 100'); 
   sql_injection_demo.show_name_sal ('Department 100', l_rows); 
   -- 
   l_rows := 
      sql_injection_demo.name_sal_for 
                    (   'department_id = 100' 
                     || ' UNION select ''USER: '' || username, 1 from all_users' 
                    ); 
   sql_injection_demo.show_name_sal ('Department 100 PLUS Users', l_rows); 
END;