ASP.NET parameters calling in SQL command (code behind)

Question

how to call an asp parameter in a sql command exp:

cmd.CommandText = "SELECT name FROM server WHERE code="+TextBox1.Text;

is it correct? .

it is NOT. check here: stackoverflow.com/questions/6043389/… — Davide Piras
– Davide Piras, Commented Oct 25, 2011 at 9:05

Marc Gravell · Accepted Answer · 2011-10-25 09:05:57Z

6

(tries and fails to suppress a shudder)

 cmd.CommandText =  "SELECT name FROM server WHERE code=@code";
 cmd.Parameters.AddWithValue("code", TextBox1.Text);

otherwise, you are just ripe for SQL injection.

NEVER CONCATENATE USER-INPUT INTO COMMANDS

answered Oct 25, 2011 at 9:05

Marc Gravell

1.1m273 gold badges2.6k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.