tags:

views:

494

answers:

1
+3  Q: 

Best way to avoid SQL injection on MSSQL Server from C# code using Linq?

What is the best way to avoid SQL injection on MSSQL Server from C# code using Linq?

Should you use a function to strip of security issues or is it handled by the framework?

+7  A: 

Errr, you cant SQL inject using LINQ. Behind the scenes LINQ to SQL converts values into a parameterized query.

So yes it is handled by the framework.

Jon Limjap  2008-10-30 09:45:18
Technically speaking you can still have SQL injection issues if you use the ExecuteCommand or call stored procedures that use sp_execute and combine string input together without proper encoding.
DamienG  2008-10-30 18:17:14

related questions

Displaying Flash content in a C# WinForms application
How to get the value of built, encoded ViewState?
Unhandled Exception Handler in .NET 1.1
How do I connect to a database and loop over a recordset in C#?
How do I most elegantly express left join with aggregate SQL as LINQ query
Get a new object instance from a Type in C#
.NET Testing Framework Advice
Automatically update version number
What is the difference between an int and an Integer in Java/C#?
How to write to Web.Config in Medium Trust ?
WinForms ComboBox data binding gotcha
How do you sort a C# dictionary by value?
Adding Scripting functionality to .NET applications
Floating Point Number parsing: Is there a Catch All algorithm?
How do I print an HTML document from a web service?
Decoding T-SQL CAST in C#/VB.net
Anatomy of a "Memory Leak"
How do I get a distinct, ordered list of names from a DataTable using Linq
Reliable Timer in a Console Application
How do I fill a DataSet or a DataTable from a LINQ query resultset ?
What's the difference between Math.Floor() and Math.Truncate() in .NET?
How do I calculate relative time?
How do I calculate someone's age in C#?
Are there any conversion tools for porting Visual J# code to C#?
When setting a form's opacity should I use a decimal or double?