title: MySQL Stored Procedure SQL Injection
body: <p>I'm coming from an Oracle world where I can use DBMS_SQL for dynamic SQL with an unknown number of bind variables.  Apparently this is not possible in MySQL.  So my question is how do you protect against SQL Injection in MySQL?  I thought this would be easy to lookup but every example I find is with PHP &amp; MySQL.  I'm only dealing with MySQL stored procedures, no PHP.  Here is a snippet:</p>
  
  <pre><code>set @sql_string=concat(@sql_string,'col1=''',someRandomText,''' where col2=''',moreRandomText,''';');
  </code></pre>
  
  <p>Is there a protection function that could be applied to <code>someRandomText</code> to prevent SQL Injection (<a href="http://bobby-tables.com/" rel="nofollow">http://bobby-tables.com/</a>)?</p>
  
  <p>Thanks!</p>