# Avoiding SQL Injection attacks using procedures

**URL:** <https://community.cdata.com/t/avoiding-sql-injection-attacks-using-procedures/778>\
**Category:** CData Virtuality \[Archived\]\
**Tags:** article, cdata-virtuality\
**Created:** [June 10, 2024, 7:47pm UTC](https://community.cdata.com/t/avoiding-sql-injection-attacks-using-procedures/778 "2024-06-10T19:47:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonymous](https://avatars.discourse-cdn.com/v4/letter/a/8491ac/32.png) [@anonymous](https://community.cdata.com/u/anonymous)\
**Post date:** [June 10, 2024, 7:47pm UTC](https://community.cdata.com/t/avoiding-sql-injection-attacks-using-procedures/778/1 "2024-06-10T19:47:13Z")

</div>

SQL injections are a common security issue when users are given the freedom to construct their queries. One way to avoid them is by creating a custom procedure that acts as a wrapper, eliminating any risk of injection.  
Here is an example procedure for filtering&nbsp; **hand\_on.cust** &nbsp;view using country filter.

```auto
CREATE PROCEDURE hands_on.parametrizedQuery(IN filter_string STRING NOT NULL) RETURNS (City STRING NOT NULL, Company STRING NOT NULL) AS BEGIN DECLARE STRING sql_string = 'SELECT City, CompanyName FROM hands_on.cust WHERE hands_on.cust.country = DVARS.country'; EXECUTE IMMEDIATE sql_string AS City STRING, CompanyName STRING INTO #temptbl USING country=filter_string; SELECT * FROM #temptbl; END;;

```

You can call it using a&nbsp; **CALL** &nbsp;functionality

```auto
CALL hands_on.parametrizedQuery('China');;

```

Or, if the&nbsp; **CALL** &nbsp;is not available, you can query it like a table and specify the input variable name and value in a&nbsp; **WHERE** &nbsp;statement.

```auto
SELECT * from hands_on.parametrizedQuery where filter_string='China';;

```