Sanity Check - Concatenating Date Values - SQL Injection

We currently receive parameters of values as VARCHAR's, and then build a date from them. I am wanting to confirm that the method below would stop the possibility of SQL injec开发者_如何转开发tion from this statement:

select CONVERT(datetime, '2010' + '-' + '02' + '-' + '21' + ' ' + '15:11:38.990')

Another note is that the actual parameters being passed through to the stored proc are length bound at (4, 2, 2, 10, 12) VARCHAR's in correspondence to the above.

if you put use the statement like this, within a stored procedure:

select CONVERT(datetime, @Year + '-' + @Month + '-' + @Day+ ' ' + @Time)

then you should be fine, since the target datatype datetime will only receive valid date strings.

if you use it like this in your stored procedure:

EXEC ('select CONVERT(datetime, @Year+''-''+@Month+''-''+@Day+'' ''+ @Time)')

you could have an issue, unlikely, since the input strings are limited to a short length, but who knows what some hacker will think up to fit in that tiny space.

if that statement is a stored procedure, you won't suffer from sql injection anyway

if that statement is generated in a language - php for example - then just make sure you escape the strings on the way in (replace ' with \' for mysql or '' for mssql) to avoid injection attacks.