View Single Post

   
  #1 (permalink)  
Old 02-28-2008, 07:44 PM
Cliff
 
Posts: n/a
Default security hole in stored procedure

here's my stored procedure:

CREATE PROCEDURE proc
@id varchar(50),@pswd varchar(20),@no_go int OUTPUT
AS
SET NOCOUNT ON
SELECT user_id FROM profile
WHERE user_id=\@id AND pswd=\@pswd
IF \@\@ROWCOUNT = 0
BEGIN
SET \@no_go = 1
END
ELSE
BEGIN
SELECT date,date_mod FROM ans
WHERE user_id=\@id
SET \@no_go = 0
END

Using the PERL odbc_more_results function I can retrieve the data in
the second select statement whether the rowcount is 0 or not. Any
suggestions how to stop this
Reply With Quote