"sysdesigner" <sysdesigner@discussions.microsoft.com> wrote in message
news:14E94EB7-AA64-4D07-86AF-0B8E02A9F57A@microsoft.com...
> Hi all,
>
> I am designing a system that will be exposing reports to the internet via
a
> link provided from within a .Net application. We want to use Dynamic SQL
> because the end users building the reports wont be able to implement
stored
> procedures. Are there any security reasons not to do this?
>
>
> Many thanks,
> Shawn

"Wayne Snyder" <wayne.nospam.snyder@mariner-usa.com> wrote in message
news:%23HCk0mtYFHA.3620@TK2MSFTNGP09.phx.gbl...
> Dynamic SQL isn't so risky on its face... BUT if you allow people to enter
> text which becomes part of the Dnamic SQL, you can get into trouble - SQL
> Injection...
>
> --
> Wayne Snyder MCDBA, SQL Server MVP
> Mariner, Charlotte, NC
> (Please respond only to the newsgroup.)
>
> I support the Professional Association for SQL Server ( PASS) and it's
> community of SQL Professionals.
> "sysdesigner" <sysdesigner@discussions.microsoft.com> wrote in message
> news:14E94EB7-AA64-4D07-86AF-0B8E02A9F57A@microsoft.com...
>> Hi all,
>>
>> I am designing a system that will be exposing reports to the internet via
> a
>> link provided from within a .Net application. We want to use Dynamic SQL
>> because the end users building the reports wont be able to implement
> stored
>> procedures. Are there any security reasons not to do this?
>>
>>
>> Many thanks,
>> Shawn
>
>