SQL injection and parameterized stored procedures

[Stan Prosedur]

Is SQL injection an issue with SP's?

tia

[Aaron Bertrand [MVP]]

> Is SQL injection an issue with SP's?

As long as you replace ' with '' then you *should* be fine...

Some will argue that using a command object (which forces strong typing of
parameters, among other things) will protect you "better" but I don't
necessarily agree that it is one of the command object's strengths.

A

[Jeff Cochran]

On Tue, 4 Nov 2003 16:53:22 -0800, "Stan Prosedur" <St**@Prosedur.com>
wrote:

Is SQL injection an issue with SP's?

Sure. Anytime a SP accepts a parameter and the parameter can be
entered as an injection routine, it's a factor. The normal SQL
injection fixes work as well, escaping single quotes, etc.

Jeff

[Stan Prosedur]

Thanks to the both of you.

:-)
"Jeff Cochran" <jc*************@naplesgov.com> wrote in message
news:3f****************@msnews.microsoft.com...

On Tue, 4 Nov 2003 16:53:22 -0800, "Stan Prosedur" <St**@Prosedur.com>
wrote:

Is SQL injection an issue with SP's?

Sure. Anytime a SP accepts a parameter and the parameter can be
entered as an injection routine, it's a factor. The normal SQL
injection fixes work as well, escaping single quotes, etc.

Jeff