Skip to content Skip to sidebar Skip to footer
Home / Ado / Code Injection / Delphi / Sql Server

Is Fieldbyname Injection-safe?

Post a Comment
I'm talking about Delphi + ADO + MSSQL. Okay, I know that queries with parameters are quite safe against SQL-injections. On the other hand, dynamic queries are quite not safe. Bu

Solution 1:

It is safe. Ado is using parameters for Update/Insert/Delete.

You can trace this with SQLProfile, e.g.

exec sp_executesql N'UPDATE"test".."Activity"SET"data"=@P1WHERE"InvokeTime"=@P2AND"data"=@P3',N'@P1 float,@P2 datetime,@P3 float',1,'2013-04-2410:46:22.933',0,48607825089780715

exec sp_executesql N'INSERTINTO"test".."Activity" ("InvokeTime","data") VALUES (@P1,@P2)',N'@P1 datetime,@P2 float','2000-01-0100:00:00',2

exec sp_executesql N'DELETEFROM"test".."Activity"WHERE"InvokeTime"=@P1AND"data"=@P2',N'@P1 datetime,@P2 float','2000-01-0100:00:00',3

Post a Comment for "Is Fieldbyname Injection-safe?"