SQL injection with Entity Framework

Question

I am using Entity Framework 4.1 and use the following code for calling a stored procedure. Please advice me, whether this code can be attacked via SQL injection.

DbContext.Database.SqlQuery<TElement>("Name Of SP", params object[] parameters).

BlackTigerX · Accepted Answer · 2013-09-23 16:07:24Z

2

Yes it can, sql injection occurs when there is any type of string concatenation, if the stored procedure does string concatenation to execute a command inside, you would still be vulnerable

answered Sep 23, 2013 at 16:07

BlackTigerX

6,1667 gold badges42 silver badges50 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

SQL injection with Entity Framework

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related