4

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

The parameters are passed to the function ExecuteDataSet() unvalidated.

Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.

0

No, no additional validation is needed to prevent SQL injection. This pattern is safe. When you're dealing with a stored procedure that simply uses the parameter values as predicate values in the SQL statement (WHERE p = @p) SQL Server knows that the value of the parameter is data, not an executable statement. Executing the contents of the parameter is not possible.

The only time you really need to be concerned about the value of parameter that you're passing into a stored procedure is when you're explicitly executing it inside the proc, using EXEC, EXECUTE, or sp_executesql.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.