Home/ Questions/Q 8787763
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-13T21:58:17+00:00

We have a use case where an app that sends out emails finds a

  • 0

We have a use case where an app that sends out emails finds a specific string (‘smart tag’) in an email and replaces it with the results of a stored procedure.

So for example the email could have Dear <ST:Name> in the body, and then the code would identify this string, run the stored procedure to find the client name passing in the client id as a parameter.

The list of these tags and the stored procedures that need to be run are currently hard coded, so every time a new ‘smart tag’ needs to be added, a code change and deployment is required.

Our BA’s our skilled in SQL and want to be able to add new tags manually.

Is it bad practice to store the procedure and parameters in a database table? Would this be a suitable design for such a table? Would it be necessary to store parameter type?

SmartTag 

SmartTagId   SmartTag   StoredProcedure

SmartTagParameters 

SmartTagParameterId   SmartTagId   ParameterName
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Table driven configuration, data driven programming, is good.

    The primary thing to watch out for is SQL Injection risk (or in your case it would be called ‘tag injection’…): one could use the email as an attack vector to gain elevated privileges by inserting a crafted procedure that would be run under higher privileges. Note that this is more than just the usuall caution around SQL Injection, since you are already accepting arbitrary code to be executed. This is more of a sandboxing problem.

    Typical problems are from the type system: parameters have various types but the declaration tables have a string type for them. SQL_VARIANT can help.

    Another potential problem is the language to declare and discover tags. Soon you’ll be asked to recognize <tag:foo>, but only before <tag:bar>. A fully fledged context sensitive parser usually follows shortly after first iteration… It would be helpful if you can help by leveraging something already familiar (eg. think how JQuery uses the CSS selector syntax). HTMLAgilityPack could help you perhaps (and btw, this is a task perfect for SQLCLR, don’t try to build elaborate statefull parser in T-SQL…).

    • 0