Timeline for How to send parameters to BCP inside dynamic sql using sp_executesql
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 20, 2019 at 13:16 | comment | added | Scott Hodgin - Retired | @GHauan - I think you'll have to validate your input parameters (outside of the sp_executesql) before building the dynamic SQL to execute the BCP command. I'm not sure how susceptible BCP would be to SQL injection (especially the Queryout), but you could certainly code up a before sp_executesql with parameters to select for a valid reportid. | |
| Feb 20, 2019 at 12:52 | comment | added | GHauan | But won't that negate the purpose of parameterization in sp_executesql? We wanted to use that to protect against injection. With your example I think it will be vulnerable to sql injection? | |
| Feb 20, 2019 at 12:06 | history | undeleted | Scott Hodgin - Retired | ||
| Feb 20, 2019 at 12:06 | history | edited | Scott Hodgin - Retired | CC BY-SA 4.0 |
added 1 character in body
|
| Feb 20, 2019 at 12:00 | history | deleted | Scott Hodgin - Retired | via Vote | |
| Feb 20, 2019 at 11:57 | history | answered | Scott Hodgin - Retired | CC BY-SA 4.0 |