While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet
Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)
Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from
DatabaseProviderFactory which comes from
Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:
CREATE procedure sp_name ( @para1 VARCHAR(25), @para2 VARCHAR(25) ) as SELECT x,y FROM mytable WHERE p = @para1 AND q = @para2 go
The parameters are passed to the function ExecuteDataSet() unvalidated.
Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.
I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.