Injection Attack - Guru Needed.

Hello all,

I have a question on whether the following stored precedure would be open to an SQL Injection attack. Assume that a string query would be passed to the SP.

I am told that because the password parameter is only varchar(8) that it is safe.

Can someone prove this wrong?

Thanks....

I have added sample code below.

CREATE TABLE [dbo].[JB_Test](
[Name] [varchar](50) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NULL CONSTRAINT [DF_JB_Test_Name] DEFAULT (''),
[Email] [varchar](100) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NULL CONSTRAINT [DF_JB_Test_Email] DEFAULT (''),
[Password] [varchar](8) COLLATE SQL_Latin1_General_CP1_CI_AS NOT NULL CONSTRAINT [DF_JB_Test_Password] DEFAULT (''),

) ON [PRIMARY]
GO

Insert dbo.JB_Test (Name, Email, Password )
values ('John', 'asdf@asdf.com', '2345')
Insert dbo.JB_Test (Name, Email, Password )
values ('Paul', 'asdf@asdf.com', '2345')
Insert dbo.JB_Test (Name, Email, Password )
values ('Geroge', 'asdf@asdf.com', '2345')
Insert dbo.JB_Test (Name, Email, Password )
values ('Ringo', 'asdf@asdf.com', '2345')

GO

Create procedure dbo.JB_Test_Login

@Username varchar(100),
@Password varchar(8)

AS

select Name
from dbo.JB_Test
where Name = @Username
and Password = @Password
GO


--Clean Up Your Mess
--Drop procedure dbo.JB_Test_Login
--GO

--Drop Table dbo.JB_Test
--GO


JBelthoff
• Hosts Station is a Professional Asp Hosting Provider
• Position SEO can provide your company with SEO Services at an affordable price
› As far as myself... I do this for fun!