在ajax数据中发送存储过程

Question

I need send stored procedure with parameter in ajax data.

Below is my example, after send get this error

Apostrophes real problem,any solution?

function sendData(userNameVal, procedureNameVal, jsonCallBackFunc) {
    var stringVal = "wsInsertData N'EXECUTE carInsert N''160655'',N''data:image/png;base64,AAAAAAAAAAAA'',N''18602''', N'18602'";

     $.ajax({
                    type: "POST",
                    url: 'helloService.asmx/myService',
                    data: "{userName:\"" + userNameVal + "\",procedureName:\"" + stringVal + "\",callback:\"" + jsonCallBackFunc + "\",}",

                    dataType: 'json',
                    contentType: 'application/json; charset=utf-8',
                    success: function (response) {
                        $('#lblError').html(JSON.stringify(response));
                    },
                    error: function (error) {
                        console.log(error);
                    }
                });
            }

Answer 1

Security! All it takes is a user to edit the JSON response to the server and add their own SQL, and they can make your SQL server do anything they want. Pass whatever parameters you need, and have the server construct the Stored Proc after sanitizing possible crazy inputs from the client.

Answer 2

在“回调”之前，添加单引号“，该引号不会终止。