Lazycoder

SQL Injection via SQL Parameters?

Possible SQL Injection via SQL Parameters?

Pick up “Writing Secure Code v.2″, They discuss how a SQL parameter can be used as an injection attack.

Mostly, the examples I’ve seen center around the “exec” statement, either embedded in the code or in an SProc.

sqlString = "exec sp_DoSomeStuff '" + inputFromUser + "'";
SqlCommand cmd = new SqlCommand(conn,sqlString)