Re: SQL Injection with ADO parameters

Parameters are much more secure that building strings with concatenation as
long as you also avoid dynamic SQL on the back-end. Also, you get better
performance and don't have to worry about embedded quotes and date
formatting.

--
Hope this helps.

Dan Guzman
SQL Server MVP

"Gaspar" <noreply@xxxxxx> wrote in message
news:upRZrJzMGHA.3728@xxxxxxxxxxxxxxxxxxxxxxx
Is it possible to hack SQL Server with injection via ADO Parameters?

Suppose I have the following query "SELECT * FROM myTable WHERE id =
:param"?
I know that the following is unsafe: "SELECT * FROM myTable WHERE id = " +
value, but what about using parameters like the example above?

Thanks!




.