|
Scalar = 1 value, something that can fit into a variable that isn't a collection or an array. You can get the return value to javascript using a hidden input form field.
You can build an ASPX page that the javascript calls, and have that page execute your procedure and put the results in a hidden field.
Your database server shouldn't be reachable from just any random person's computer who's looking at your page. Forget SQL Injection - that only happens when a person can guess how your application works, and give just hte right input to trick it into running a query they want run. Imagine the fun that comes when people can just send any query they like directly, using javascript. Think
DECLARE @SQL VARCHAR(MAX)
SELECT @SQL = 'TRUNCATE TABLE ' + NAME FROM SYS.TABLES
EXEC (@SQL)
Bye bye all the data in your database.
Why would you ever want to let people talk directly to your SQL Server themselves?
|