{"id":10269,"date":"2026-06-05T15:59:01","date_gmt":"2026-06-05T06:59:01","guid":{"rendered":"https:\/\/www.auctionpro.co.kr\/?p=10269"},"modified":"2026-06-05T16:00:10","modified_gmt":"2026-06-05T07:00:10","slug":"sp_executesql","status":"publish","type":"post","link":"https:\/\/www.auctionpro.co.kr\/?p=10269","title":{"rendered":"sp_executesql"},"content":{"rendered":"\n

1. \uad6c\uc870<\/h2>\n\n\n\n

sp_executesql<\/code> \ubb38\ubc95<\/p>\n\n\n\n

EXEC sp_executesql\n    @statement,\n    @params,\n    @param1=value1,\n    @param2=value2,\n    ...<\/pre><\/div>\n\n\n\n
2. EXEC(@sql) \uc640 \ucc28\uc774<\/h2>\n\n\n\n
\uc704\ud5d8\ud55c \ubc29\ubc95<\/h3>\n\n\n\n
SET @sql =\n'SELECT *\n FROM MYDATA\n WHERE Address=''' + @Address + ''''\n\nEXEC(@sql)<\/pre><\/div>\n\n\n\n
\ub9cc\uc57d<\/p>\n\n\n\n
@Address =\n'ABC123'' OR 1=1 --'<\/pre><\/div>\n\n\n\n
\uc774\uba74<\/p>\n\n\n\n
SELECT *\nFROM MYDATA\nWHERE ddress='ABC123' OR 1=1 --<\/pre><\/div>\n\n\n\n
\uac00 \ub418\uc5b4 SQL Injection \uacf5\uaca9\uc774 \uac00\ub2a5\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
\uc548\uc804\ud55c \ubc29\ubc95<\/h3>\n\n\n\n
EXEC sp_executesql\n    @sql,\n    N'@Address varchar(6)',\n    @Address=@Address<\/pre><\/div>\n\n\n\n
\ud30c\ub77c\ubbf8\ud130\uac00 \uac12\uc73c\ub85c \ucc98\ub9ac\ub418\ubbc0\ub85c<\/p>\n\n\n\n
OR 1=1<\/pre><\/div>\n\n\n\n
\uac19\uc740 \ubb38\uc790\uc5f4\ub3c4 \ub2e8\uc21c \ub370\uc774\ud130\ub85c \ucde8\uae09\ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
EXEC(@sql)<\/pre><\/div>\n\n\n\n
\ubc18\uba74<\/p>\n\n\n\n
sp_executesql<\/code><\/pre>\n\n\n\n
\uc740 \uc2e4\ud589 \uacc4\ud68d(Execution Plan)\uc744 \uc7ac\uc0ac\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4.<\/p>\n\n\n\n
1. \uc65c EXEC(@SQL)<\/code>\uc740 \uc704\ud5d8\ud560\uae4c?<\/h2>\n\n\n\n
\uc800\uc7a5 \ud504\ub85c\uc2dc\uc800\uac00 \uc548\uc804\ud55c \uc774\uc720\ub294 \ubcf4\ud1b5 \ud30c\ub77c\ubbf8\ud130\ud654\ub41c \ucffc\ub9ac(Parameterized Query)\ub97c \uc0ac\uc6a9\ud574 \uc785\ub825\uac12\uc744 ‘\ub370\uc774\ud130’\ub85c\ub9cc \ucde8\uae09\ud558\uae30 \ub54c\ubb38\uc785\ub2c8\ub2e4.<\/p>\n\n\n\n
\ud558\uc9c0\ub9cc EXEC(@SQL)<\/code> \ucc98\ub7fc \ubb38\uc790\uc5f4\uc744 \ub354\ud574\uc11c \ub3d9\uc801 SQL\uc744 \ub9cc\ub4e4\uba74, SQL Server\ub294 \uadf8 \ucd5c\uc885 \ubb38\uc790\uc5f4\uc744 \ucc98\uc74c\ubd80\ud130 \ub2e4\uc2dc \ucef4\ud30c\uc77c<\/strong>\ud569\ub2c8\ub2e4. \uc774\ub54c \uc0ac\uc6a9\uc790\uac00 \uc785\ub825\ud55c \uc545\uc758\uc801\uc778 SQL \uad6c\ubb38\uc774 \ub370\uc774\ud130\uac00 \uc544\ub2cc \uc2e4\ud589 \uac00\ub2a5\ud55c \uba85\ub839\uc5b4\ub85c \ubcc0\ud658<\/strong>\ub418\uba74\uc11c \ubcf4\uc548 \uad6c\uba4d\uc774 \ub6ab\ub9ac\uac8c \ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
\ud83d\udea8 \ucde8\uc57d\ud55c \ucf54\ub4dc \uc608\uc2dc<\/h3>\n\n\n\n
SQL<\/p>\n\n\n\n
CREATE PROCEDURE usp_GetUserInfo\n    @SearchName NVARCHAR(100)\nAS\nBEGIN\n    DECLARE @SQL NVARCHAR(MAX);\n    \n    -- \ubb38\uc790\uc5f4\uc744 \ub2e8\uc21c\ud788 \ub354\ud574\uc11c \ub3d9\uc801 SQL\uc744 \uc0dd\uc131 (\ub9e4\uc6b0 \uc704\ud5d8!)\n    SET @SQL = 'SELECT * FROM Users WHERE UserName = ''' + @SearchName + '''';\n    \n    EXEC(@SQL);\nEND;\n<\/code><\/pre>\n\n\n\n
\ub9cc\uc57d \uacf5\uaca9\uc218\uac00 @SearchName<\/code> \uc785\ub825\uac12\uc73c\ub85c admin' OR '1'='1<\/code> \ub610\ub294 admin'; DROP TABLE Users; --<\/code>\ub97c \uc785\ub825\ud55c\ub2e4\uba74, \uc2dc\uc2a4\ud15c\uc740 \uadf8\ub300\ub85c \ud14c\uc774\ube14\uc744 \uc0ad\uc81c\ud558\uac70\ub098 \uc804\uccb4 \ud68c\uc6d0 \uc815\ubcf4\ub97c \ub178\ucd9c\ud558\uac8c \ub429\ub2c8\ub2e4.<\/p>\n\n\n\n
2. \uc548\uc804\ud558\uac8c \ub3d9\uc801 SQL\uc744 \uc791\uc131\ud558\ub294 \ubc29\ubc95<\/h2>\n\n\n\n
\ub3d9\uc801 SQL\uc774 \ubc18\ub4dc\uc2dc \ud544\uc694\ud55c \uc0c1\ud669(\uc608: \uac80\uc0c9 \uc870\uac74\uc774 \ub9e4\ubc88 \ub2ec\ub77c\uc9c0\ub294 \ub3d9\uc801 \uac80\uc0c9 \ucffc\ub9ac \ub4f1)\uc774\ub77c\uba74, EXEC(@SQL)<\/code> \ub300\uc2e0 sp_executesql<\/code>\uc744 \uc0ac\uc6a9\ud574\uc57c \ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
sp_executesql<\/code>\uc740 \ub3d9\uc801 SQL \uc548\uc5d0\uc11c\ub3c4 \ud30c\ub77c\ubbf8\ud130 \ubc14\uc778\ub529<\/strong>\uc744 \uc9c0\uc6d0\ud558\uae30 \ub54c\ubb38\uc5d0, \uc0ac\uc6a9\uc790\uac00 \uc774\uc0c1\ud55c \uac12\uc744 \uc785\ub825\ud574\ub3c4 \uc548\uc804\ud558\uac8c \ucc98\ub9ac\ud569\ub2c8\ub2e4.<\/p>\n\n\n\n
\u2705 \uc548\uc804\ud55c \ucf54\ub4dc \uc608\uc2dc (sp_executesql<\/code> \uc0ac\uc6a9)<\/h3>\n\n\n\n
SQL<\/p>\n\n\n\n
CREATE PROCEDURE usp_GetUserInfo_Safe\n    @SearchName NVARCHAR(100)\nAS\nBEGIN\n    DECLARE @SQL NVARCHAR(MAX);\n    DECLARE @ParamList NVARCHAR(500);\n    \n    -- 1. \ucffc\ub9ac \ud2c0\uc744 \ub9cc\ub4e4\uace0 \ubcc0\uc218\uba85(@pName)\uc744 \uc9c0\uc815\ud569\ub2c8\ub2e4. (\ubb38\uc790\uc5f4 \ub354\ud558\uae30 \uae08\uc9c0)\n    SET @SQL = 'SELECT * FROM Users WHERE UserName = @pName';\n    \n    -- 2. \ub3d9\uc801 SQL \ub0b4\ubd80\uc5d0\uc11c \uc0ac\uc6a9\ud560 \ud30c\ub77c\ubbf8\ud130\uc758 \ud0c0\uc785\uc744 \uc815\uc758\ud569\ub2c8\ub2e4.\n    SET @ParamList = '@pName NVARCHAR(100)';\n    \n    -- 3. sp_executesql\uc744 \ud1b5\ud574 \ud30c\ub77c\ubbf8\ud130\ub97c \uc548\uc804\ud558\uac8c \ubc14\uc778\ub529\ud558\uc5ec \uc2e4\ud589\ud569\ub2c8\ub2e4.\n    EXEC sp_executesql @SQL, @ParamList, @pName = @SearchName;\nEND;\n<\/code><\/pre>\n\n\n\n
\ud83d\udca1 \uc694\uc57d \ubc0f \uccb4\ud06c\ub9ac\uc2a4\ud2b8<\/h2>\n\n\n\n