C# Sql query with unnamed parameters

Question

I have a query like this:

SELECT * FROM Table1 WHERE Column1 = {0} AND Column2 = {1}

And I want to execute that statement and send a list of parameters that contains values which should replace {0} and {1}. A list of objects with 2 elements.

I have only found solution with named parameters by now, but I dont want named parameters, I want to do it in the way specified above...

You can use String.Format() and replace {0},{1} with parameter value. — Suprabhat Biswal
– Suprabhat Biswal, Commented Oct 14, 2015 at 8:09
Why You don't want to use parameterized query? It's really bad approach and opens your app for SQL injection attack. — Rahul Singh
– Rahul Singh, Commented Oct 14, 2015 at 8:11
By the way, string.Format does not prevent SQL Injection attacks. Consider to using parameterized statements instead. — Soner Gönül
– Soner Gönül, Commented Oct 14, 2015 at 8:11
@RahulSingh is correct non-parameterized queries are vulnerable to Sql injection attack . — Suprabhat Biswal
– Suprabhat Biswal, Commented Oct 14, 2015 at 8:14
Thanks on advice, but only in this specific case which we are working on we must use this approach. And only admin will have access to that route, there wont be sql injection attacks. — Aleksa
– Aleksa, Commented Oct 14, 2015 at 8:18

Andrey Korneyev · Accepted Answer · 2015-10-14 08:10:44Z

5

This string looks like format string for String.Format and has nothing to do with parameterized query.

Basically you shouldn't use String.Format and other string concatenation operations to create sql query since it leads to sql injection.

Using parameterized queries with SqlCommand.Parameters is safer way, consider using it.

answered Oct 14, 2015 at 8:10

Andrey Korneyev

26.9k16 gold badges73 silver badges72 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

C# Sql query with unnamed parameters

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related