SQL-Injection - dynamischer select

Code: Alles auswählen.

  data fieldlist type string.
  fieldlist = |* from PA0001 where pernr = '123' into table @data(bla). delete pa0001 where pernr = '123'. commit work. data bla2 type char10. bla2 = 'Xilukarim'. select ekko~*, ekpo~*|.

  data from_parameter type string.
  from_parameter = 'ekko join ekpo on ekpo~ebeln = ekko~ebeln'.

  data where_parameter type string.
  where_parameter = |ekko~ebeln = '1234'|.

  "select ekko~*, ekpo~*
  try.
    select (fieldlist)
      from (from_parameter)
      where (where_parameter)
      into table @<lt_result>.

    CATCH CX_SY_DYNAMIC_OSQL_SEMANTICS INTO DATA(lx).
      write: / |SQL-Semantic-Fehler: { lx->get_text( ) }|.
      "RAISE EXCEPTION lx.
    catch CX_SY_DYNAMIC_OSQL_SYNTAX into data(lx2).
      write: / |SQL-Syntax-Fehler: { lx2->get_text( ) }|.
    ENDTRY.