|
by kimberly.nospam@nospam.sqlskills.com (kltripp) via Kimberly L. Tripp on 6/30/2009 8:34:00 AM
I've always been concerned with security and I've always stressed the importance of auditing the REAL user context not just the current user (see this post on EXECUTE AS and auditing). So, I generally try to avoid using dynamic string execution and if necessary create well tested/protected parameters (fyi - using QUOTENAME can be a fantasic solution to protectng identifiers as input parameters but it can't protect more complex strings).
Having said that, what if I'm looking a
... [ read more ]
|
