Merge 1ce6ed760c into d6714bb77a

docs/docs/en/guide/task/sql.md

@@ -28,6 +28,7 @@ Refer to [datasource-setting](../howto/datasource-setting.md) `DataSource Center
 | SQL statement     | SQL statement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | UDF function      | For Hive DataSources, you can refer to UDF functions created in the resource center, but other DataSource do not support UDF functions.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | Custom parameters | SQL task type, and stored procedure is a custom parameter order, to set customized parameter type and data type for the method is the same as the stored procedure task type. The difference is that the custom parameter of the SQL task type replaces the `${variable}` in the SQL statement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| SQL injection     | You can use SQL injection to change SQL, which will replace `!{Variable}` in the SQL statement. For example, `select * from A where a = !{Variable}`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | Pre-SQL           | Pre-SQL executes before the SQL statement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | Post-SQL          | Post-SQL executes after the SQL statement.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
 

docs/docs/zh/guide/task/sql.md

@@ -28,6 +28,7 @@ SQL任务类型，用于连接数据库并执行相应SQL。
 - sql语句：SQL语句
 - UDF函数：对于HIVE类型的数据源，可以引用资源中心中创建的UDF函数，其他类型的数据源暂不支持UDF函数。
 - 自定义参数：SQL任务类型，而存储过程是自定义参数顺序，给方法设置值自定义参数类型和数据类型，同存储过程任务类型一样。区别在于SQL任务类型自定义参数会替换sql语句中${变量}。
+- sql注入: 可以使用sql注入的方式更改sql，会替换sql语句中的`!{变量}` 例如 ` select * from A where a = !{变量}`
 - 前置sql:前置sql在sql语句之前执行。
 - 后置sql:后置sql在sql语句之后执行。