Principals

Technical Article

RE: Passing a querystring to a stored procedure?

  • Reply

- keep sql-injection in mind ! Check http://qa.sqlservercentral.com/columnists/chedgate/sqlinjection.asp- just define your variables as sp-parameters and handle your statement in your sp. You will soon discover it's best to work with known predicates.- check http://www.sommarskog.se/dynamic_sql.html and http://www.sommarskog.se/dyn-search.html

You rated this post out of 5. Change rating

2004-03-03

Blogs

Deleting Old Local Git Branches–#SQLNewBlogger

By

I had a lot of local branches for a repo (actually a few repos)....

Use Your Voice

By

If you want more of a career and less of a job, one thing...

Real-World SQL Mastery: Your Hands-On, Mess-Free Sandbox

By

Are you ready to take your SQL skills from theoretical to tactical? If you've...

Read the latest Blogs

Forums

7 sept, scheduled book

By philip.scott

Comments posted to this topic are about the item 7 sept, scheduled book

7 sept, schedlued article

By philip.scott

Comments posted to this topic are about the item 7 sept, schedlued article

6 sept, published book

By philip.scott

Comments posted to this topic are about the item 6 sept, published book

Visit the forum

Question of the Day

Azure Data Lake Storage Gen 2

Azure Data Lake Storage Gen 2 is built on ...?

See possible answers