Re: Reduce large amount of logicals in SUBFL pgm, take in another direction

Anytime you have
wSqlStmt = 'SELECT<..> ' + userEnteredValue;

The technical answer is _YES_ it is vulnerable.

It may be difficult (and involve more work than the average hacker
would be willing to do), but it could be done...

This example:

For example, the panel the user sees might have:
_Location
_Department
_Class
Where they would enter 1, 2, and 3 to denote the sort sequence. This
scenario would not be susceptible to injection, would it?

in which case you'd have
if sortLoc = 1;
wSqlStmt += ' ORDER BY location ';
endif;

if sortDept = 1;
wSqlStmt += ' ORDER BY department ';
endif;
<...>

doesn't directly concatenate the user value to the statement and this
is not vulnerable.