title: Using 'where..in' inside store procedure with prepared statements (Safe Way)
body: <p>Im trying to secure my store procedure to avoid SQL Injection attacks using prepared</p>
  <p>statements. with the guide that mentioned here :</p>
  <p>&quot;https://dev.mysql.com/doc/refman/8.0/en/sql-prepared-statements.html&quot;</p>
  <pre><code>mysql&gt; PREPARE stmt1 FROM 'SELECT SQRT(POW(?,2) + POW(?,2)) AS hypotenuse';
  mysql&gt; SET @a = 3;
  mysql&gt; SET @b = 4;
  mysql&gt; EXECUTE stmt1 USING @a, @b;
  +------------+
  | hypotenuse |
  +------------+
  |          5 |
  +------------+
  mysql&gt; DEALLOCATE PREPARE stmt1;
  </code></pre>
  <p>I have no problem with passing parameter one by one.</p>
  <p>Now if i have to pass array of item to SP from java and use 'where..in' , what is the best</p>
  <p>approach ?</p>
  <p>I can use something like this :</p>
  <pre><code>SET @somestring  = '1,3,18,25';
  SET @s=CONCAT(&quot;
  SELECT * FROM city 
  WHERE id IN (&quot;,@somestring,&quot;);&quot;);
  PREPARE stmt FROM @s;
  EXECUTE stmt;
  </code></pre>
  <p>Dont know if is it secure enough for injection , since i guess its not checking parameter</p>
  <p>one by one while it not use &quot;USING @a, @b&quot;.</p>