Do I need to sanitise the parameters to a SQL Stored Procedure? -

i'm writing quick website in asp (classic) javascript.

i'm using prepared statement parameter. nothing special.

my question need sanitise input parameter (if so, there native functions in php?), or fact i'm using parameter rather concatenating inline sql make me safe?

//set command run getmigrationdate stored procedure. var command = new activexobject("adodb.command"); command.commandtext = "exec mystoredproc ?";  //set parameters command.parameters.append(command.createparameter("name", 200, 1, 255)); command.parameters("name") = name;  //set result recordset var results = new activexobject("adodb.recordset");  //run command results.open(command); 

[edit] stored proc this:

@name varchar(255)  select * customers name = @name 

your stored procedure using bind variables , not building sql statement parameters you're passing in don't need sanitize parameters in order avoid sql injection.

in other circumstances, may want sanitize them other reasons (say, if "name" displayed , want avoid attack types in small javascript program field gets displayed back). normally, taken care of in code renders field ensuring you're not storing rogue javascript in database backup.