Question

I’ve got the SQL stored procedure from hell that I’ve created and all input parameters are parameterised for security but it’s not running as quick as I’d like so I wanted to make it dynamic and so a bit more efficient.

I know I can keep my input parameters to my stored procedure, then within it create a dynamic SQL statement into which I can then pass the input parameters of the stored procedure, but are there any security implications I need to be aware of when doing this? I’m guessing not as it just another set of parameters and they should be treated the same as the parameters passed to the current stored procedure.

Obviously, producing code like this “WHERE OrderNo = ‘ + @orderno is asking for trouble – I will be doing ‘WHERE OrderNo = @orderno’ in the dynamic SQL, but is there anything else I need to be aware of?
Thx MH

PS – before anyone suggests it, I can’t create the SQL dynamically at the client side using LINQ or similar – it all (for various reasons) has to be contained and controlled at the database level

Answer 1

There is a form of SQL injection that many people don’t think about when doing dynamic SQL in stored procedures: SQL Truncation attacks.

With a SQL truncation attack, the attacker injects a long peace of text making the used text variable overflow and lose part of the query.

This article gives more information about this.