Mistake: trusting login fields because ordinary tests pass. Without input validation, user-supplied values can alter dynamically built SQL instead of remaining data. section 14.7
A login that accepts more than credentials
A normal login produces a query matching Pete and Password1. A username such as ' OR 1=1-- can turn the predicate true and comment out the password check. The safer practice is to pass login values as stored-procedure parameters rather than concatenate them into SQL. section 14.7
Listing 14.20 Simulating the use of a login stored procedure
DECLARE @UserName NVARCHAR(128) = 'Pete' ; DECLARE @Password NVARCHAR(128) = 'Password1' ; EXEC dbo.Login @username, @password ; #1 SET @UserName = ''' OR 1=1--' ; SET @Password = 'randomchars' ; EXEC dbo.Login @username, @password ; #2
Compare an ordinary login with an injected value while tracing how parameterized procedure calls receive the same inputs. section 14.7
