security hole in stored procedure here's my stored procedure:
CREATE PROCEDURE proc
@id varchar(50),@pswd varchar(20),@no_go int OUTPUT
AS
SET NOCOUNT ON
SELECT user_id FROM profile
WHERE user_id=\@id AND pswd=\@pswd
IF \@\@ROWCOUNT = 0
BEGIN
SET \@no_go = 1
END
ELSE
BEGIN
SELECT date,date_mod FROM ans
WHERE user_id=\@id
SET \@no_go = 0
END
Using the PERL odbc_more_results function I can retrieve the data in
the second select statement whether the rowcount is 0 or not. Any
suggestions how to stop this |