title: Do I need to worry about a SQL injection for an SSRS report that uses a stored procedure for its main dataset?
body: <p>I have a report and I want to add a single valued text parameter (allows nulls). This parameter will be passed to a stored procedure. If this parameter is null, the SP will ignore it. However, if the parameter is not null, then I want the SP to parse through it and use some of the values contained within.</p>
  
  <p>Users will be passing in values in the form <code>whse=Blah&amp;whse=Blah2&amp;item=item1&amp;lot=lotA&amp;date:IsNull=True&amp;um=&amp;client=client2</code>. As you might guess, these are parameter names and values for a report. My idea is to allow the user to pass in some parameter values that they want in this form. </p>
  
  <p>However, I'm worried that someone could enter in some malicious text to try to damage my database. Do I need to worry about this, given that I am using SQL Server 2008 R2 and SyteLine 8? Or are there already protections in place for this and I shouldn't have to worry? </p>