Using SOQL Injection to delete data

Question

I know that SOQL injection can be used to query data the user shouldn't see by providing a value like Bob \' OR Name LIKE '%'. But I'm wondering if you could use an input value like Name LIKE '%')'; delete [SELECT Id FROM Contact]; // to delete all contacts from an org. Is something like this possible, or does Apex prevent this?

Example below. I tried running this, but am getting the error mismatched character '<EOF>' expecting '''

@AuraEnabled
    // whereClause value: Name LIKE '%')'; delete [SELECT Id FROM Contact]; //
    public static void soqlInjectionTest(String whereClause) {
        String queryString = 'SELECT Id FROM Contact WHERE ' + whereClause;
        List<Contact> contacts = Database.query(queryString);
    }

Answer 1

Apex compiler will error out as you cannot provide apex statement as string and then expect compiler to compile automatically.

Answer 2

SOQL and SQL are distant cousins. Unlike SQL, you cannot have multiple statements in SOQL, can't execute arbitrary Apex, and you can't even perform DML statements of any kind. As such, the absolutely worst possible scenario is that someone can see data they shouldn't, and even that requires elevated privileges (which is why you should always use with sharing/inherited sharing).