DB statement values are seen for some spans whereas it is seen as '?' in others

[Shubhangi]

Kibana version: 6.8

Elasticsearch version: 6.8

APM Server version: 6.8

APM Agent language and version: 1.9 Java

Browser version : Firefox 66.0.3 (64-bit)

Original install method (e.g. download page, yum, deb, from source, etc.) and version: binary files from elastic.co

Fresh install or upgraded from other version? fresh

Description of the problem including expected versus actual behavior. Please include screenshots (if relevant):
The DB statements of spans in APM are inconsistent with capturing SQL statement parameters. It is seen in some of the spans(see below)

SELECT a.*, oa.* FROM gblapplications a LEFT JOIN gblorgapp oa ON a.appid=oa.oraappid WHERE (oa.oraorgid=? OR a.appid=2 OR a.appid=9540) AND a.appsas=1 AND a.appid!=1 AND a.approwstate>0 AND oa.orarowstate>0 GROUP BY a.appid ORDER BY a.appname

The above span has duration more than 10ms.
while it is not seen in some of the statements(see below)

select * from gblusrpreferences where oruid=? and oruorgid=?

SET time_zone = ?

The above spans have duration more than 10ms.
I've configured APM with properties:
transaction_sample_rate=0.9
span_frames_min_duration=10ms

The parameters would really help with the analysis. Response would be appreciated.
Thanks!

[felixbarny (Felix Barnsteiner)]

@Shubhangi

The DB statements of spans in APM are inconsistent with capturing SQL statement parameters.

The agent is not capturing the parameters of prepared statements. If you see parameters within the SQL statement it means that you are not using prepared statements or that you do use them but also parameterize your SQLs by concatenating parameters to the string. This can potentially mean that there's a SQL injection attach vector.

There's currently no configuration option which makes the agent capture prepared statement parameters.