Stored procedures - when to use?

Question

Hello
I'm a self-taught ASP developer who never found out about
stored procedures until recently. I've got a hacker trying to put
me out of business, livelihood, psychological health etc. by
repeatedly attacking my database with SQL injections. So I have
thousands of pages on 30 websites to go through and recode, using
SPs.
An easy - and probably stupid question - do I need to use SPs
when there is no user variable involved? i.e. I know they're
required when I want to
"SELECT Field FROM Table WHERE ID =" &
Request("Variable")
But is the following format OK, or should it be converted to
an SP too?
"SELECT Field FROM Table "
Thanks for any guidance!
Square

Answer 1

> An easy - and probably stupid question - do I need to
use SPs when there
> is no
> user variable involved? i.e. I know they're required
when I want to
The basic premise of SQL injection is that it takes end-user
inputted
strings and sends it directly to SQL.
NEVER trust your end users. ;o)
So, in the example you gave, you're not grabbing any
user-created strings
and passing it along, so no, one can't SQL inject that.
You can avoid SQL injection without SPs, but it takes a lot
of work. You
need to filter all user input first to ensure it is 'clean'
of malicious
code, and then pass it on. It's usually easier to just use
SPs, so that's
usually the stock answer.
-Darrel