{"id":10269,"date":"2026-06-05T15:59:01","date_gmt":"2026-06-05T06:59:01","guid":{"rendered":"https:\/\/www.auctionpro.co.kr\/?p=10269"},"modified":"2026-06-11T14:53:16","modified_gmt":"2026-06-11T05:53:16","slug":"sp_executesql","status":"publish","type":"post","link":"https:\/\/www.auctionpro.co.kr\/?p=10269","title":{"rendered":"\uc548\uc804\ud55c \ub3d9\uc801 SQL \uc791\uc131: sp_executesql\uc758 \uc774\uc810"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">1. \uad6c\uc870<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>sp_executesql<\/code> \ubb38\ubc95<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">EXEC sp_executesql\n    @statement,\n    @params,\n    @param1=value1,\n    @param2=value2,\n    ...<\/pre><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">2. EXEC(@sql) \uc640 \ucc28\uc774<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">\uc704\ud5d8\ud55c \ubc29\ubc95<\/h3>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:tsql decode:true \">SET @sql =\n'SELECT *\n FROM MYDATA\n WHERE Address=''' + @Address + ''''\n\nEXEC(@sql)<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\ub9cc\uc57d<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:c# decode:true \">@Address =\n'ABC123'' OR 1=1 --'<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\uc774\uba74<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:c# decode:true \">SELECT *\nFROM MYDATA\nWHERE ddress='ABC123' OR 1=1 --<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\uac00 \ub418\uc5b4 SQL Injection \uacf5\uaca9\uc774 \uac00\ub2a5\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\uc548\uc804\ud55c \ubc29\ubc95<\/h3>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:c# decode:true \">EXEC sp_executesql\n    @sql,\n    N'@Address varchar(6)',\n    @Address=@Address<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\ud30c\ub77c\ubbf8\ud130\uac00 \uac12\uc73c\ub85c \ucc98\ub9ac\ub418\ubbc0\ub85c<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:c# decode:true \">OR 1=1<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\uac19\uc740 \ubb38\uc790\uc5f4\ub3c4 \ub2e8\uc21c \ub370\uc774\ud130\ub85c \ucde8\uae09\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n<div class=\"wp-block-urvanov-syntax-highlighter-code-block\"><pre class=\"lang:c# decode:true \">EXEC(@sql)<\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">\ubc18\uba74<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sp_executesql<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\uc740 \uc2e4\ud589 \uacc4\ud68d(Execution Plan)\uc744 \uc7ac\uc0ac\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. \uc65c <code>EXEC(@SQL)<\/code>\uc740 \uc704\ud5d8\ud560\uae4c?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\uc800\uc7a5 \ud504\ub85c\uc2dc\uc800\uac00 \uc548\uc804\ud55c \uc774\uc720\ub294 \ubcf4\ud1b5 \ud30c\ub77c\ubbf8\ud130\ud654\ub41c \ucffc\ub9ac(Parameterized Query)\ub97c \uc0ac\uc6a9\ud574 \uc785\ub825\uac12\uc744 &#8216;\ub370\uc774\ud130&#8217;\ub85c\ub9cc \ucde8\uae09\ud558\uae30 \ub54c\ubb38\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\ud558\uc9c0\ub9cc <code>EXEC(@SQL)<\/code> \ucc98\ub7fc \ubb38\uc790\uc5f4\uc744 \ub354\ud574\uc11c \ub3d9\uc801 SQL\uc744 \ub9cc\ub4e4\uba74, SQL Server\ub294 \uadf8 \ucd5c\uc885 \ubb38\uc790\uc5f4\uc744 <strong>\ucc98\uc74c\ubd80\ud130 \ub2e4\uc2dc \ucef4\ud30c\uc77c<\/strong>\ud569\ub2c8\ub2e4. \uc774\ub54c \uc0ac\uc6a9\uc790\uac00 \uc785\ub825\ud55c \uc545\uc758\uc801\uc778 SQL \uad6c\ubb38\uc774 \ub370\uc774\ud130\uac00 \uc544\ub2cc <strong>\uc2e4\ud589 \uac00\ub2a5\ud55c \uba85\ub839\uc5b4\ub85c \ubcc0\ud658<\/strong>\ub418\uba74\uc11c \ubcf4\uc548 \uad6c\uba4d\uc774 \ub6ab\ub9ac\uac8c \ub429\ub2c8\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udea8 \ucde8\uc57d\ud55c \ucf54\ub4dc \uc608\uc2dc<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SQL<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>CREATE PROCEDURE usp_GetUserInfo\n    @SearchName NVARCHAR(100)\nAS\nBEGIN\n    DECLARE @SQL NVARCHAR(MAX);\n    \n    -- \ubb38\uc790\uc5f4\uc744 \ub2e8\uc21c\ud788 \ub354\ud574\uc11c \ub3d9\uc801 SQL\uc744 \uc0dd\uc131 (\ub9e4\uc6b0 \uc704\ud5d8!)\n    SET @SQL = 'SELECT * FROM Users WHERE UserName = ''' + @SearchName + '''';\n    \n    EXEC(@SQL);\nEND;\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\ub9cc\uc57d \uacf5\uaca9\uc218\uac00 <code>@SearchName<\/code> \uc785\ub825\uac12\uc73c\ub85c <code>admin' OR '1'='1<\/code> \ub610\ub294 <code>admin'; DROP TABLE Users; --<\/code>\ub97c \uc785\ub825\ud55c\ub2e4\uba74, \uc2dc\uc2a4\ud15c\uc740 \uadf8\ub300\ub85c \ud14c\uc774\ube14\uc744 \uc0ad\uc81c\ud558\uac70\ub098 \uc804\uccb4 \ud68c\uc6d0 \uc815\ubcf4\ub97c \ub178\ucd9c\ud558\uac8c \ub429\ub2c8\ub2e4.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. \uc548\uc804\ud558\uac8c \ub3d9\uc801 SQL\uc744 \uc791\uc131\ud558\ub294 \ubc29\ubc95<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\ub3d9\uc801 SQL\uc774 \ubc18\ub4dc\uc2dc \ud544\uc694\ud55c \uc0c1\ud669(\uc608: \uac80\uc0c9 \uc870\uac74\uc774 \ub9e4\ubc88 \ub2ec\ub77c\uc9c0\ub294 \ub3d9\uc801 \uac80\uc0c9 \ucffc\ub9ac \ub4f1)\uc774\ub77c\uba74, <code>EXEC(@SQL)<\/code> \ub300\uc2e0 <code>sp_executesql<\/code>\uc744 \uc0ac\uc6a9\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>sp_executesql<\/code>\uc740 \ub3d9\uc801 SQL \uc548\uc5d0\uc11c\ub3c4 <strong>\ud30c\ub77c\ubbf8\ud130 \ubc14\uc778\ub529<\/strong>\uc744 \uc9c0\uc6d0\ud558\uae30 \ub54c\ubb38\uc5d0, \uc0ac\uc6a9\uc790\uac00 \uc774\uc0c1\ud55c \uac12\uc744 \uc785\ub825\ud574\ub3c4 \uc548\uc804\ud558\uac8c \ucc98\ub9ac\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\u2705 \uc548\uc804\ud55c \ucf54\ub4dc \uc608\uc2dc (<code>sp_executesql<\/code> \uc0ac\uc6a9)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SQL<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>CREATE PROCEDURE usp_GetUserInfo_Safe\n    @SearchName NVARCHAR(100)\nAS\nBEGIN\n    DECLARE @SQL NVARCHAR(MAX);\n    DECLARE @ParamList NVARCHAR(500);\n    \n    -- 1. \ucffc\ub9ac \ud2c0\uc744 \ub9cc\ub4e4\uace0 \ubcc0\uc218\uba85(@pName)\uc744 \uc9c0\uc815\ud569\ub2c8\ub2e4. (\ubb38\uc790\uc5f4 \ub354\ud558\uae30 \uae08\uc9c0)\n    SET @SQL = 'SELECT * FROM Users WHERE UserName = @pName';\n    \n    -- 2. \ub3d9\uc801 SQL \ub0b4\ubd80\uc5d0\uc11c \uc0ac\uc6a9\ud560 \ud30c\ub77c\ubbf8\ud130\uc758 \ud0c0\uc785\uc744 \uc815\uc758\ud569\ub2c8\ub2e4.\n    SET @ParamList = '@pName NVARCHAR(100)';\n    \n    -- 3. sp_executesql\uc744 \ud1b5\ud574 \ud30c\ub77c\ubbf8\ud130\ub97c \uc548\uc804\ud558\uac8c \ubc14\uc778\ub529\ud558\uc5ec \uc2e4\ud589\ud569\ub2c8\ub2e4.\n    EXEC sp_executesql @SQL, @ParamList, @pName = @SearchName;\nEND;\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udca1 \uc694\uc57d \ubc0f \uccb4\ud06c\ub9ac\uc2a4\ud2b8<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><code>EXEC(@SQL)<\/code> + \ubb38\uc790\uc5f4 \ub354\ud558\uae30 (<code>+<\/code>)<\/strong>: SQL \uc778\uc81d\uc158\uc5d0 <strong>\ubb34\ubc29\ube44\ub85c \ub178\ucd9c<\/strong>\ub429\ub2c8\ub2e4.<\/li>\n\n\n\n<li><strong><code>sp_executesql<\/code> + \ud30c\ub77c\ubbf8\ud130 \uc9c0\uc815<\/strong>: \uc785\ub825\uac12\uc774 \uc644\uc804\ud788 \ubd84\ub9ac\ub418\uc5b4 \ub370\uc774\ud130\ub85c\ub9cc \ucc98\ub9ac\ub418\ubbc0\ub85c <strong>\uc548\uc804<\/strong>\ud569\ub2c8\ub2e4.<\/li>\n\n\n\n<li>\ud14c\uc774\ube14 \uc774\ub984\uc774\ub098 \uceec\ub7fc \uc774\ub984 \uc790\uccb4\uac00 \ub3d9\uc801\uc73c\ub85c \ubc14\ub00c\uc5b4\uc57c \ud574\uc11c \uc5b4\uca54 \uc218 \uc5c6\uc774 \ubb38\uc790\uc5f4\uc744 \ub354\ud574\uc57c \ud55c\ub2e4\uba74, <code>QUOTENAME()<\/code> \ud568\uc218\ub97c \uc0ac\uc6a9\ud574 \uc785\ub825\uac12\uc744 \uac15\uc81c\ub85c \ub300\uad04\ud638(<code>[]<\/code>)\ub85c \uac10\uc2f8 \ubcf4\ud638\ud574\uc57c \ud569\ub2c8\ub2e4.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>1. \uad6c\uc870 sp_executesql \ubb38\ubc95 2. EXEC(@sql) \uc640 \ucc28\uc774 \uc704\ud5d8\ud55c \ubc29\ubc95 \ub9cc\uc57d \uc774\uba74 \uac00 \ub418\uc5b4 SQL Injection \uacf5\uaca9\uc774 \uac00\ub2a5\ud569\ub2c8\ub2e4. \uc548\uc804\ud55c \ubc29\ubc95 \ud30c\ub77c\ubbf8\ud130\uac00 \uac12\uc73c\ub85c \ucc98\ub9ac\ub418\ubbc0\ub85c \uac19\uc740 \ubb38\uc790\uc5f4\ub3c4 <a class=\"mh-excerpt-more\" href=\"https:\/\/www.auctionpro.co.kr\/?p=10269\" title=\"\uc548\uc804\ud55c \ub3d9\uc801 SQL \uc791\uc131: sp_executesql\uc758 \uc774\uc810\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":6,"featured_media":10281,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[16,88],"tags":[],"class_list":["post-10269","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mssql-server","category-mysql"],"jetpack_featured_media_url":"https:\/\/www.auctionpro.co.kr\/wp-content\/uploads\/2026\/06\/pexels-photo-34803995.jpeg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/10269","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10269"}],"version-history":[{"count":0,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/posts\/10269\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=\/wp\/v2\/media\/10281"}],"wp:attachment":[{"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10269"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10269"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.auctionpro.co.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10269"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}