== Stored Procedures

=== Safe Stored Procedure (Microsoft SQL Server)
-------------------------------------------------------
CREATE PROCEDURE ListCustomers(@Country nvarchar(30)) 
AS 
SELECT City, COUNT(*)
FROM Customers 
WHERE Country LIKE @Country GROUP BY City


EXEC ListCustomers ‘USA’
-------------------------------------------------------

=== Injectable Stored Procedure (Microsoft SQL Server)
-------------------------------------------------------
CREATE PROEDURE getUser(@lastName nvarchar(25)) 
AS 
declare @sql nvarchar(255)
set @sql = 'select * from users where 
            LastName = + @LastName + ' 
exec sp_executesql @sql 
-------------------------------------------------------
