I want to have inserted data in stored procedure, because of of sql injection I use prepare and execute statement.
what should I've done to have the inserted data
following code is only a part of user table
DELIMITER ;;
CREATE PROCEDURE `UserCreate`
(
IN `@Name` VARCHAR(32)
)
BEGIN
SET @Query = CONCAT
(
'INSERT INTO
User
(
Name
VALUES
('
, '\'' , `@Name` , '\','
')'
);
PREPARE Statement FROM @Query;
EXECUTE Statement;
DEALLOCATE PREPARE Statement;
END ;;
DELIMITER ;
- I use Binary uuid for having more security