SQL injection and parameterized stored procedures

[Stan Prosedur]

Is SQL injection an issue with SP's?

tia

 

[Aaron Bertrand [MVP]]

Is SQL injection an issue with SP's?

As long as you replace ' with '' then you *should* be fine...

Some will argue that using a command object (which forces strong typing of
parameters, among other things) will protect you "better" but I don't
necessarily agree that it is one of the command object's strengths.

A

 

[Jeff Cochran]

Is SQL injection an issue with SP's?

Sure. Anytime a SP accepts a parameter and the parameter can be
entered as an injection routine, it's a factor. The normal SQL
injection fixes work as well, escaping single quotes, etc.

Jeff

 

[Stan Prosedur]

Thanks to the both of you.

Sure. Anytime a SP accepts a parameter and the parameter can be
entered as an injection routine, it's a factor. The normal SQL
injection fixes work as well, escaping single quotes, etc.

Jeff