Sorry about the question heading
I am creating an online tower defense game with SQL Server 2008 as my database.
SQL user used to send data to server is restricted to only execute existing storeprocedures which means to do anything like building or destroying a tower a storeprocedure has to be used. Now in the case of destroying of towers a storeprocedure named "sp_remove_tower" is fired with just 1 parameter "UserId" which will tell the database from which account the tower has to be removed.
is that if a person has SQL Server 2008 management studio installed and gets the SQL Server Name, SQL User ID, SQL User Password from lets say through inspect element in google chrome or by hacking the game itself. Then he can randomly pass any UserId in the storeprocedure which will cause to delete towers from other innocent players account.
How do i stop such a thing from happening?
Thanks in advance