Click here to Skip to main content
15,889,281 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I study so much about SQL Injection and how to prevent it.

But I have a doubt related to SQL Injection:

I know that SQL Injection is Possible in Dynamic Queries,
Like
SQL
ALTER PROCEDURE sp_GetProduct(@Name NVARCHAR(50))
AS
BEGIN
    DECLARE @sqlcmd NVARCHAR(MAX);
    SET @sqlcmd = N'SELECT * FROM tbl_Product WHERE Name = ''' + @Name + '''';

    EXECUTE(@sqlcmd)
END


and attack is possible by just passing value of @name variable as:
Shampoo'; DROP TABLE tbl_Product; --



Now I use Non-Dynamic Query in SP
Like:
SQL
ALTER PROCEDURE sp_GetProduct(@Name NVARCHAR(50))
AS
    SELECT * FROM tbl_Product WHERE Name = @Name;



So My Question Is: When I use Non-Dynamic Queries,
Q1. SQL injection is Possible and If yes then
Q2. How...
Give me some ideas......
Posted
Updated 18-Jun-14 17:32pm
v4
Comments
Mike Meinz 18-Jun-14 8:20am    
SELECT * FROM tbl_Product WHERE Name = @Name; does not allow SQL Injection attack because the contents of @Name is treated as a parameter value that is compared to the database column name rather than as a part of the SQL statement to be parsed.

1 solution

No.
A parameter is different: it doesn't go through the SQL input parser, which is where SQL injection happens.
Because @Name is never parsed - just it's content used to compare with DB items - it cannot be executed and so there can be no injection into the SQL command.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900