What is the Sql server equivalent for Oracle DBMS_ASSERT?

Question

DBMS_ASSERT is one of the keys to preventing SQL injection attacks in Oracle. I tried a quick look ... is there an SQL Server 2005/2008 equivalent for this feature?

I am looking for a specific implementation that has an analogue of all the relevant elements of the Oracle DBMS_ASSERT package.

• NOOP
• SIMPLE_SQL_NAME
• QUALIFIED_SQL_NAME
• SCHEMA_NAME

I know the best practices for preventing injection ... bind variables ... being one of them.
But on this question, I'm specifically looking for a good way to sanitize input ... in scripts where bind-variables were not used.

Do you have any specific features?
Is there a library that is actually an Oracle SQL Server port?

Answer 1

, , - QUOTENAME, (, , SIMPLE_SQL_NAME ENQUOTE_NAME , , . , ( ) .

(, "bob" "database.owner.bob" ), , QUOTENAME , :

QUOTENAME(@database) + '.' + QUOTENAME(@owner) + '.' + QUOTENAME(@tableName)

, DB_NAME() , :

DB_NAME() + '.' + QUOTENAME(@owner) + '.' + QUOTENAME(@tablename)

:

USER_NAME(OBJECTPROPERTY(OBJECT_ID(@tablename), 'ownerid')))

, , , .

: SQL Server, . UDF, , , , , , sproc sp_ExecuteSQL SQL Server.

Answer 2

, EXECuting .

sp_executesql .

, SQL- .

EDIT: , . sp_execute, sp_executesql; : SQL Server.

EDIT2: sp_executesql

Answer 3

, , TSQLAssert TSQLMacro, TSQL. .

TSQLAssert - TSQLMacro. , , ++ - . TSQLAssert - , , .

Answer 4

" ". :

• 1. 2., '' ' , SQL.

Answer 5

- DBMS_ASSERT Sql Server, . , PROC, .

Microsoft - , .

Answer 6

, SQL SERVER DBMS_ASSERT.

SQL Injection