Re: SQL Injection Prevention

From: Aaron [SQL Server MVP] (ten.xoc_at_dnartreb.noraa)
Date: 09/28/04 

Date: Tue, 28 Sep 2004 10:50:23 -0400

> Therefore my statement stays that parameterized SQL select
> (insert/update/delete) actually provides better protection against SQL
> injection than parameterized call to stored procedure.

I'm not sure I understand where you've proven that parameterized DML
statements are better than parameterized stored procedure calls. 

-- 
http://www.aspfaq.com/
(Reverse address to reply.)

Relevant Pages

  • Re: SQL Injection Prevention
    ... If you write a bad SP it's possible to introduce injection vulnerabilities. ... I'm just saying that when it concerns to SQL injection, ... >> built stored procedure so it's obvious which will win. ...
    (microsoft.public.sqlserver.server)
  • Re: SQL Injection Prevention
    ... If you write a bad SP it's possible to introduce injection vulnerabilities. ... I'm just saying that when it concerns to SQL injection, ... >> built stored procedure so it's obvious which will win. ...
    (microsoft.public.dotnet.security)
  • Re: SQL Injection Prevention
    ... > Therefore my statement stays that parameterized SQL select ... > injection than parameterized call to stored procedure. ... statements are better than parameterized stored procedure calls. ... (Reverse address to reply.) ...
    (microsoft.public.dotnet.security)
  • [Full-disclosure] SQL Injection with cursors?
    ... I have an injection point, where I can do, for example ... and injections of the sort, and retrieve the information without problems. ... when I try to execute a stored procedure like ... Microsoft OLE DB Provider for SQL Server error '80040e14' ...
    (Full-Disclosure)
  • [Full-disclosure] SQL Injection with cursors?
    ... I have an injection point, where I can do, for example ... and injections of the sort, and retrieve the information without problems. ... when I try to execute a stored procedure like ... Microsoft OLE DB Provider for SQL Server error '80040e14' ...
    (Full-Disclosure)