Re: How to pass column name to a stored proc as a parameter

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: Adi (adico_at_clalit.org.il)
Date: 10/05/04 

Date: 5 Oct 2004 12:08:33 -0700

You can use Dynamic SQL in order to do that, but make sure that you
understand the security problems that this might cause you. The
ownership chain will get broken and you'll have to grant permissions on
the base table. Beside that make sure that you validate the user's
input. If you won't validate it, then SQL Injection might be used
against your database through your application.

Adi

Relevant Pages

  • Stored Procedures - Advanced Questions
    ... I've used inline dynamic SQL extensively (although I've used stored ... procedures are used in relative to the middle-tier. ... I'll use an "Employees" table. ... Where do you validate? ...
    (microsoft.public.sqlserver.programming)
  • SQL contains clause validation problem
    ... sp_executesql statement on the dynamic sql string. ... figure out the best way to validate the input passed from visual basic to my ... single search terms must be surrounded by quotes, ... quotes, and may contain noise words, but all words within the phrase must ...
    (microsoft.public.dotnet.languages.vb)
  • Re: SQL contains clause validation problem
    ... We're aware of the risks of dynamic SQL, but unfortunately until SQL Server ... > I'm wondering why you need to filter out noise words when SQL Server ... If you need to validate your input strings, ...
    (microsoft.public.dotnet.languages.vb)
  • Re: SP accessing other db
    ... > so dynamic SQL always breaks the ownership chain. ... > The larger issue is why you need to use multiple databases. ... > chain security so that permissions on indirectly referenced objects are ...
    (microsoft.public.sqlserver.security)
  • Re: Can this work - soft code SP table name in parameter?
    ... unless you validate the name. ... names anyway then you may as well avoid Dynamic SQL and just code the ... WHERE idf = @id ... DELETE FROM table2 ...
    (microsoft.public.sqlserver.programming)