> I mean, just writing to ~/.bash_profile wont work as i assume it needs to be executable.

It does not. It's an RC file sourced by the shell, not a script.

> It is very rare to get sql injection at the beginning of the query so in practise this usually isn't an issue (although i guess that was your point).

Yes. Would also be required to use these vulnerabilities.