Example of SQL injection attack?

Question

1. What is an example of an SQL injection attack for compromising the database?

2. What classes of SQL injection attacks cannot be prevented by the use of bind variables and why not?

3. How do bind variables help in preventing SQL injection attacks?

Answer 1

1. http://xkcd.com/327/
2. Speaking of native prepared statements - all the query literals which aren't supported (i.e. everything but simple strings and numbers) are obviously vulnerable, when not hardcoded.
3. https://stackoverflow.com/a/8265319/285587

Answer 2

1.:

Here's an example from the real world:

https://find-and-update.company-information.service.gov.uk/company/10542519

Since the company is still listed the attack seems to be unsuccessful as yet, however, in the case the injection succeeds in the future, I'll also include a screenshot.