Re: security hole

From: Dan Guzman (danguzman_at_nospam-earthlink.net)
Date: 01/28/04 

Date: Wed, 28 Jan 2004 08:23:45 -0600

If you simply want to exit the procedure, use RETURN line the example below.

IF @@ROWCOUNT = 0
BEGIN
    SET @no_go = 1
    RETURN
END
ELSE
BEGIN
    SELECT date,date_mod FROM ans
    WHERE user_id = @id
    SET @no_go = 0
END 

-- 
Hope this helps.
Dan Guzman
SQL Server MVP
"clifford" <cmi88@aol.com> wrote in message
news:eKhVJla5DHA.1596@TK2MSFTNGP10.phx.gbl...
> here's my stored procedure:
>
> CREATE PROCEDURE proc
> @id varchar(50),@pswd varchar(20),@no_go int OUTPUT
> AS
> SET NOCOUNT ON
> SELECT user_id FROM profile
> WHERE user_id = @id AND pswd = @pswd
> IF @@ROWCOUNT = 0
> BEGIN
> SET @no_go = 1
> END
> ELSE
> BEGIN
> SELECT date,date_mod FROM ans
> WHERE user_id = @id
> SET @no_go = 0
> END
>
> I've written a PERL script that gets the data from the second SELECT
whether
> rowcount is 0 or not.  Is there a way to make the procedure die, so perl
> can't get to the second statement?
>
>