Hi,
In My project i am using Stored Procedures to Avoid Sql Injection. One of sample Stored Procedure code is below please confirm me is it correct way to avoid SQL Injection
ALTER PROCEDURE [dbo].[Proc_LoginCheck]
(
@EmailAddress varchar(50),
@Password varchar(30)
)
AS
BEGIN
SELECT *,FirstName+' '+LastName as name
FROM tbl_Users
WHERE Email=@EmailAddress and Password=@Password
AND RoleId = 2 and Status = 'Yes' and IsDeleted!='Yes'
END
I am Getting errors. when performing with firefox extension tool (Sql Inject Me).
I am getting errors with __VIEWSTATE, __EVENTVALIDATION and all the input controls. How can i prevent from SQL Injection. Please guide me.
...
Go to the complete details ...