Aiuto Store procedure

>

USE tempdb;

CREATE TABLE dbo.Students(
StudentID int NOT NULL IDENTITY PRIMARY KEY,
FirstName varchar(10) NOT NULL,
LastName varchar(10) NOT NULL
);

INSERT dbo.Students VALUES('Lorenzo', 'Benaglia');
INSERT dbo.Students VALUES('Luca', 'Bianchi');
INSERT dbo.Students VALUES('Andrea', 'Montanari');
INSERT dbo.Students VALUES('Gianluca', 'Hotz');
GO

CREATE PROCEDURE dbo.up_GetData(
@Table sysname
)
AS
EXEC ('SELECT * FROM ' + @Table);
GO

EXEC dbo.up_GetData N'dbo.Students';

/* Output:

StudentID   FirstName  LastName   
----------- ---------- ---------- 
1           Lorenzo    Benaglia
2           Luca       Bianchi
3           Andrea     Montanari
4           Gianluca   Hotz

(4 row(s) affected)

*/

/* Simulo un attacco di SQL Injection */
EXEC dbo.up_GetData N'dbo.Students; DROP TABLE dbo.Students;';

/* Output:

StudentID   FirstName  LastName   
----------- ---------- ---------- 
1           Lorenzo    Benaglia
2           Luca       Bianchi
3           Andrea     Montanari
4           Gianluca   Hotz

(4 row(s) affected)

*/

EXEC dbo.up_GetData N'dbo.Students';

/* Output:

Server: Msg 208, Level 16, State 1, Line 1
Invalid object name 'dbo.Students'.

*/

DROP PROCEDURE dbo.up_GetData;