I have an SQL query taking in a column name from backend.
SELECT ${sequenceName}.NEXTVAL FROM DUAL
I am doing this in MyBatis, and while usually I'd stick to #{} instead of ${}, in this case i need the string concatanation, so I am unable to prevent SQL injection this way. Is there a solution or method where SQL injection does not occur when I am doing dynamic queries and string substitution for SQL?
Perhaps something like:
SELECT (Select SEQUENCE_NAME from ALL_SEQUENCES where SEQUENCE_NAME = ?).NEXTVAL FROM DUAL
?