C#

idTextBox.Text = "Jones;DROP TABLE Table";
string sql = "Select * from Table where name = " + idTextBox.Text;

PIEBALDconsult wrote:

I have had stored procedures "just disappear"

PIEBALDconsult wrote:

Stored procedures are too easy to change in the field.

PIEBALDconsult wrote:

one reason people insist on stored procedures is because they force the developer to use parameters

string firstName = "'; DROP TABLE Whatever; --";
string cmd = "EXEC SelectData '" + firstName + "'";

aspdotnetdev wrote:

Stored procedures can help reduce network traffic

aspdotnetdev wrote:

you fix them in one location (the database) and they are fixed everywhere

aspdotnetdev wrote:

It can be difficult or impossible to control security if you allow the clients to run arbitrary SQL statements.

aspdotnetdev wrote:

If you have stored procedures, you can control exactly what executes on the server.

aspdotnetdev wrote:

Both stored procedures and plain SQL are susceptible to SQL injection.

RaviRanjankr wrote:

it will provide protection from SQL injection attacks

RaviRanjankr wrote:

it enable conditional and procedural logic,
it provide better management of Compilation and storing or Execution plan
it enable of security model and
Static stored procedure code is a lot more readable

RaviRanjankr wrote:

public class GenericFactory<T> where T : new()
{
  public T Create(){
     return new T();
  }
}