1. Joanna Wolthuis
Be a Dynamic SQL Dynamo!

2. About me… Working with SQL Server for 8 years.
Independent contractor - SQL Server/VBA development and reporting.
Big fan of VBA interaction with SQL Server (front end tools).
Contributor to Your Programming Network website and YouTube channel.
Amateur acrobat!
@ochthenoodle

3. Dynamic SQL…. What is dynamic SQL? How would we use it?
When should we use it?
How does it perform?
Is it secure?

4. Static SQL Dynamic SQL SELECT * FROM [Warehouse].[PackageTypes]
AS VARCHAR(50) = '[Warehouse].[PackageTypes]'
AS VARCHAR(MAX) = 'SELECT * FROM ‘ =

5. SQL Injection…. Little Bobby Tables

6. Erland Sommarskog…..
“if this web app logs into SQL Server with sysadmin or db_owner privileges, the attack succeeds.
Mind you, with sysadmin rights, the attacker can add users and logins as he pleases.
And if the service account for SQL Server has admin privileges in Windows, the attacker has access into your network far beyond SQL Server through xp_cmdshell.
(Which is disabled by default on SQL 2005 and later, but if the attacker has achieved sysadmin rights on the server, he can change that.)“

7. How can we prevent this? Correct permissions!!!!!!
Do not expose your SQL Server error messages
Remove special chars etc where possible
sp_executeSQL NOT EXEC

8. Feel free to email/tweet me anything you may think of later 
Questions?
Feel free to /tweet me anything you may think of later 
@ochthenoodle
Useful links: