A Novel Technique for SQL Injection in PDO's Prepared Statements

only if you're inserting user strings into the statement. meh.