Posted by figital on 03/09/06 17:07

I am researching the use of OpenXml for doing mass updates/inserts.

Does anyone know how this procedure works as far as sql injection is
concerned? I've always been taught to use sp's with parameters...does
using OpenXML open up any holes in that idea?

My thinking is that it would be fine (maybe even better), because the
fields will still be treated as literals.

Alternatively, are there any other suggestions for doing massive
amounts of updates/inserts?

[Back to original message]