Best way to avoid SQL injection on MSSQL Server from C# code using Linq?

Question

What is the best way to avoid SQL injection on MSSQL Server from C# code using Linq?

Should you use a function to strip of security issues or is it handled by the framework?

Jon Limjap · Accepted Answer · 2008-10-30 09:45:18Z

7

Errr, you cant SQL inject using LINQ. Behind the scenes LINQ to SQL converts values into a parameterized query.

So yes it is handled by the framework.

answered Oct 30, 2008 at 9:45

Jon Limjap

95.7k15 gold badges104 silver badges153 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

DamienG Over a year ago

Technically speaking you can still have SQL injection issues if you use the ExecuteCommand or call stored procedures that use sp_execute and combine string input together without proper encoding.

Collectives™ on Stack Overflow

Best way to avoid SQL injection on MSSQL Server from C# code using Linq?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related