Weird table's data in SQL server - sql-server

Question

I have a table in my database called notifications, data will be inserted into this table whenever notifications arrive from other users in my application. The table's schema looks like this:
CREATE TABLE [dbo].[notifications](
[id] [int] IDENTITY(1,1) NOT NULL,
[sender] [char](17) NULL,
[reciever] [char](17) NULL,
[letter_code] [char](15) NULL,
[txt] [nvarchar](max) NULL,
[dateandtime] [datetime2](7) NULL,
[letter_kind] [nvarchar](50) NULL,
[seen] [bit] NULL,
CONSTRAINT [PK_notifications] PRIMARY KEY CLUSTERED
(
[id] ASC
)WITH (PAD_INDEX = OFF, STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, ALLOW_ROW_LOCKS = ON, ALLOW_PAGE_LOCKS = ON) ON [PRIMARY]
) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
the inserted row must be something like this:
id || sender || reciever || letter_code || txt || dateandtime || letter_kind || seen
============================================================================================================
1 || 2 || 2 || 1734 || message || 2015-10-12 09:59:01 || PS || flase
today I was checking my database's tables, and I noticed something strange has happened. Some strange data are inserted into the notification table:
As you can see the txt column contains a very strange value:
1<div style="display:none">looking to cheat go how many men have affairs</div>
And other columns contain 1 !
Any idea?
PS: I'm sure in only one place data for this table will be written:
context.InsTotNotification(WebContext.Current.User.UserCode, CheckedUsersForSend.ElementAt(j), LetCods.ElementAt(i),
string.Format("letter kind {0} letter code {1} datetime.",
LetterKind, Convert.ToString(Convert.ToDouble(LetCods.ElementAt(i).Substring(4, 11)), CultureInfo.InvariantCulture)), DateTime.Now, LetterKind);
Update: There's no form for allowing users to input the data, data will be written using the backend not users.
Update 2: I'm using EntityFramework Database First and InsTotNotification is a stored procedure inside my context:
[Invoke]
public string InsTotNotification(string sender, string reciever,string letter_code,string Txt,DateTime dateandtime,string Letter_kind)
{
var MQuery = ObjectContext.InsTo_Notification(sender, reciever, letter_code, Txt, dateandtime, Letter_kind).FirstOrDefault();
return "Ok";
}
And here's the sp:
SET ANSI_NULLS OFF
GO
SET QUOTED_IDENTIFIER OFF
GO
ALTER PROCEDURE [dbo].[InsTo_Notification]
#Sender char(17),
#Reciever char(17),
#Letter_code char(15),
#Txt nvarchar(MAX),
#DateandTime datetime2,
#Letter_kind nvarchar(50)
AS
BEGIN TRANSACTION InsertNotifications
Declare #T1 int
INSERT notifications (sender, reciever, letter_code, txt, dateandtime, letter_kind)
values (#Sender, #Reciever, #Letter_code, #Txt, #DateandTime,#Letter_kind)
SELECT #T1=##ERROR
--------------------------
if (#T1=0)
BEGIN
COMMIT TRANSACTION InsertNotifications
SELECT #Letter_code as LetterNo
END
ELSE
BEGIN
ROLLBACK TRANSACTION InsertNotifications
SELECT 'NO' as 'It has Problem'
END
Update 3: There's also these types of rows in the table:
Notice that the text نامه PS به شماره 11968 به شما ارجاع داده شد in the selected row is the actual value for txt field.

Answer 1

definitely SQL Injection...
Is this coming from a Web application or something that can be reahed by the web, right?
Your stored procedure takes any char inputs without proper validation.
Try to check if parameters contain "<", ">", reserved SQL Server terms/statements or other unwanted chars.