I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized query.
select foo from bar where <user generated> and foo = ?
(Besides this the user generated portion is run through a filter of sorts before the query is constructed that only allows certain input)
The application uses JDBC against Mysql (Connector/J). This driver do, as far as I can understand, the preprocessing of prepared statements on the client side. If sql injection is possible, would it be possible to "escape" out of the parameterized where condition? Perhaps with subqueries?