About string parameters to stored procedure

Hi, I wrote a stored procedure to check user's name (vartype: chr) and
password (chr, too).
Do I have to check whether there is an apostrophe ("'") in the name
string and password string? I tried to put some "'"s in the name string
and didn't replace them with double "'", but it seemed you can not
cheat the stored procedure about it.
-----------------
My stored procedure (SQL server 2000):
CREATE PROCEDURE dbo.userLogin
(
@userName varchar(20),
@password varchar(20),
@userID int output
)
AS
select @userID=[id] from [user] where [name]=@userName and
[password]=@password
return @userID
-------------------

.

Relevant Pages

  • Re: About string parameters to stored procedure
    ... If you use SqlParameter on the client for parameterized queries, you are on the safe side with this sproc (and call it directly, not via some handcrafted sp_execute or exec string) ... string and password string? ... My stored procedure: ... @userID int output ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: SQL stored procedure executing twice
    ... from one parent record to another. ... Dim stDocName As String ... My pass-thru query syntax going to stored procedure ...
    (microsoft.public.access.modulesdaovba)
  • RE: MS Query "Connections"
    ... handle that with my connection string. ... for using the stored procedure route is that it is faster. ... If you truly want to pass in the query string, ...
    (microsoft.public.excel.programming)
  • Re: XML binding advice
    ... Performance - By writing the SQL statement as a stored procedure, ... execution plan will take into account any indexes you have on the tables ... each piece you add to the string. ...
    (microsoft.public.dotnet.xml)
  • Re: TableAdapter specifing IN in the where clause for list of id
    ... And till now, there products which are huge products, they are using AD-HOC ... Since IN cannot accept a delimited string but ... Muhammad replied that I could use a stored procedure to accomplish this ... specify. ...
    (microsoft.public.dotnet.framework.adonet)