views:

310

answers:

1

When using this code to insert a row with SqlCeResultSet,

SqlCeResultSet resultSet = DataAccess.OpenResultSet("MyTable");
SqlCeUpdatableRecord record = resultSet.CreateRecord();
record.SetString(1,TextBox1.Text);
resultSet.Insert(record);

Does it prevent SQL injection attacks?

+3  A: 

Yes it will prevent injection attacks. SetString will place the string into the column as passed in. There is no need to escape the string etc.

Steven