So, I haven' t to worry if I use stored proc (into database) with db parameters, user input in the web form provided for that parameters are not a danger, I understand... This no means that i don' t try to filter and proctect all the input fields, but there are fields which is very difficult and I want to be sure that using SP parameters all is secure and protected.
For instance this SP:
Sub insertData(sender As Object, e As EventArgs)
Dim CmdInsertar As New SqlCommand("new_user", strConnection)
Cmd1.CommandType = CommandType.StoredProcedure
Cmd1.Parameters.Add(New SqlParameter("@e_mail", SqlDbType.varchar, 50, "e_mail"))
Cmd1.Parameters("@e_mail").Value = mail.text
Cmd1.Parameters.Add(New SqlParameter("@Password", SqlDbType.varchar, 8, "Password"))
Cmd1.Parameters("@Password").Value = password.text
....
strConnection.open()
Cmd1.ExecuteNonQuery
strConnection.close()
End Sub
Oh and this is providing you don't use sp_execute or something in you stored procedure.
I don' t understand your commentary. I usually use this structure to execute de SP:
strConnection.open()
Cmd1.ExecuteNonQuery
strConnection.close()
C?sar