Databases
StackOverflow2013
Postsdbo
POIs this stored procedure safe from sql injection?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs this stored procedure safe from sql injection?
    text
    copied!<p>This stored proc executes sql with parameters using sp_executesql.<br > Is it safe from sql injection?</p> <pre><code>create procedure ExecutePeopleFilter (@lastNameFilter varchar(20), @companyNameFilter varchar(20), @ageFilter int, @dateFilter datetime) as begin declare @sql varchar(4000) declare @params varchar(1000) declare @whereClause varchar(1000) set @whereClause = '' if ISNULL(@lastNameFilter,'') &lt;&gt; '' begin if (LEN(@whereClause) &lt;&gt; 0) set @whereClause += ' and ' if (LEN(@lastNameFilter) &lt; 20) set @lastNameFilter += '%' set @whereClause += 'LastName like @lastName ' end if ISNULL(@companyNameFilter,'') &lt;&gt; '' begin if (LEN(@whereClause) &lt;&gt; 0) set @whereClause += ' and ' if (LEN(@companyNameFilter) &lt; 20) set @companyNameFilter += '%' set @whereClause += 'CompanyName like @companyName ' end if @ageFilter is not null begin if (LEN(@whereClause) &lt;&gt; 0) set @whereClause += ' and ' set @whereClause += 'Age = @age ' end if @dateFilter is not null begin if (LEN(@whereClause) &lt;&gt; 0) set @whereClause += ' and ' set @whereClause += 'StartDate = @startDate ' end set @sql = 'select FirstName, LastName, CompanyName, Age, StartDate from People' if (LEN(@whereClause) &lt;&gt; 0) set @sql += ' where ' + @whereClause set @params = '@lastName varchar(20), @companyName varchar(20), @age int, @startDate datetime' execute sp_executesql @sql, @params, @lastName = @lastNameFilter, @companyName = @companyNameFilter, @age = @ageFilter, @startDate = @dateFilter end </code></pre>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload