跟随MySql存储过程易受sql注入影响吗？

Question

Read almost all the post on this but could not judge whether my procedures are vulnarable or not? Any help is appreciated.

1)calling Procedure as:

$query = ($is_mine?'call dispatch.dis_get_my_assigned_tasks("'.$username.'");'

Procedure :

CREATE DEFINER=`test`@`localhost` PROCEDURE `dis_get_all_assigned_tasks`()
BEGIN    
    select distinct at_id, at_issues, at_location, at_room_number, user_fname, 
        from dispatch.dis_assigned_tasks 
        left outer join dispatch.dis_users 
        on user_id  = at_user
    order by at_location, at_user_pickup_timestamp  desc; 
END

2) calling Procedure as :

$query = "call dispatch.dis_get_user_info('".$username."');";

Procedure :

CREATE DEFINER=`test`@`localhost` PROCEDURE `dis_get_user_info`(IN username VARCHAR(45))
BEGIN    
    select * from dispatch.dis_users where user_username = username;
END

Answer 1

The procedures are not vulnerable to SQL injection, but your queries are.

To prevent (and learn about) SQL Injection, please see our reference question:

• How can I prevent SQL injection in PHP?

For "almost all the posts on this" you say you've read it looks like that they didn't cover the topic well. I suggest you to select better material to get education from.

• SQL Injection Prevention Cheat Sheet (You need to be able to read code written in different languages)