title: SQL injection - no danger on stored procedure call (on iSeries)?
body: <p>I've done some searching around but I have a specific question on SQL Injection and hope I can get some input as I believe I may be getting the wrong end of the stick to do with field data sanitising etc :-</p>
  
  <p>I have a java program calling a stored procedure on an iSeries. The stored procedure has CL / RPG code behind the scenes. The stored procedure is called by way of parameters with the data coming from a web page. For example the call would look like the following:-</p>
  
  <pre><code>call library.prog('field1Value', 'field2Value')
  </code></pre>
  
  <p>Do I need to worry about any characters entered via the website into 'field1Value' etc or, because it is a stored procedure call, does the danger of sql injection not exist? Does it depend on whether the RPG program behind the scenes uses 'field1Value' in its own SQL statement as part of that processing?</p>
  
  <p>The field lengths passed into the proecdure are fixed length so we cannot, for example, convert 'dodgy' characters into their html equivalent.</p>
  
  <p>Appreciate any (I'm anticipating this might be a stupid question!) feedback (not necessarily iSeries specific) on this.</p>