|
by kimberly.nospam@nospam.sqlskills.com (kltripp) via Kimberly L. Tripp on 4/5/2010 9:51:00 PM
In my last post: Little Bobby Tables, SQL Injection and EXECUTE AS, I wanted to highlight how to avoid SQL Injection when using EXEC. A few people brought up the point that I could have avoided SQL Injection by using sp_executesql. And, while sp_executesql can be used in some cases, it's not always the most ideal from a performance perspective. So, to really show this, I'm going to start with focusing on the similarities and differences of EXEC and sp_executesql. I'll
... [ read more ]
|
|