SqlCommand - preventing stored proc call in other databases
Posted
by Moe Sisko
on Stack Overflow
See other posts from Stack Overflow
or by Moe Sisko
Published on 2010-03-30T06:19:39Z
Indexed on
2010/03/30
6:23 UTC
Read the original article
Hit count: 603
Filed under:
ADO.NET
|sql-server
When using SqlCommand to call a stored proc via RPC, it looks like it is possible to call a stored proc in a database other than the current database.
e.g. :
string storedProcName = "SomeOtherDatabase.dbo.SomeStoredProc";
SqlCommand cmd = new SqlCommand(storedProcName);
cmd.CommandType = CommandType.StoredProcedure;
I'd like to make my DAL code more restrictive, by disallowing potential calls to another database. One way might be to check if there are two periods (dots) in storedProcName above, and if so, throw an exception. Any other ideas/approaches ?
Thanks.
© Stack Overflow or respective owner
