4 ms·
> Edit: I've just read the query in the post again and I really can't understand why you would write it like that. Am I missing something here? Oh I've seen th
by flukus 9y ago
> Edit: I've just read the query in the post again and I really can't understand why you would write it like that. Am I missing something here?
Oh I've seen this happen a lot. Somewhere along the line, often from a DBA, it is decided that sql in an app is evil and that everything must be in a stored proc. Then instead of some simple string concatenation you have to jump through hoops like this.
- voltagex_ 9y agoOne of the things I've done to harden an app is to revoke all permissions other than EXEC on a particular schema, then make sure everything is done via paramatised stored procedures - no chance of SQL injection then.
- flukus 9y agoBut that creates situations like this where you have to jump through hoops to solve simple problems. You solved one potential issue at the cost of creating many more. > no chance of SQL injection then. You know you can have sql injection attacks inside stored procedures? If you think stored procedures are a panacea then you don't understand the problem you're solving.
- voltagex_ 9y agoPerhaps I should have said "greatly reduced the risk of". I'm not using something like Entity Framework and the CRUD apps I mostly wrote at work were well suited to a few simple sprocs. The time it takes to write an ALTER script to change something pales in comparison to the two week change control process anyway...
- voltagex_ 9y agohttps://stackoverflow.com/a/24029829/229631 https://stackoverflow.com/a/24029829/229631 https://blogs.msdn.microsoft.com/brian_swan/2011/02/16/do-stored-procedures-protect-against-sql-injection/ https://blogs.msdn.microsoft.com/brian_swan/2011/02/16/do-st... https://security.stackexchange.com/questions/68701/how-does-stored-procedure-prevents-sql-injection https://security.stackexchange.com/questions/68701/how-does-...