Is it safe to set ValidateRequest=false when using Linq to SQL?

Question

I'm using ONLY Linq to SQL for database access, so I assume it is safe to turn off request validation...

Answer 1

So you don't care about people inserting HTML/javascript onto your page that will allow them to do cross-site scripting attacks? Parameterized queries will only help protect against SQL injection, not all attack vectors.

Answer 2

It is not safe. Linq To SQL does project against SQL Injections because it passes the data as parameters.

If you shut off the validation you open yourself up to cross side scripting problems.