Sql Injection Risk at Entity Framework with Old Type Commands

Question

Is there any risk for use commands like below?

using (var db = new DbConnection())
{
    db.Database.ExecuteSqlCommand("command and maybe @param", new SqlParameter("param", param));
}

I need to use some old type commands for select protected columns and I wonder is there any sql injection risk even for entity framework.

viggity · Accepted Answer · 2015-08-13 14:52:37Z

1

As long as you're not doing any string concatenation in code OR your sql command, you are safe from SQL Injection.

EDIT

For clarification, it is ok if your parameters are string values. But if your parameter contains SQL you're probably not safe. As far as what I meant by string concatenation in your SQL command, you would likely have to use the SQL command EXEC in order to get it to work and you'd be in trouble.

SAFE:

SELECT * FROM Employees WHERE employeeId = @employeeId

DANGEROUS:

EXEC ('SELECT * FROM Employees WHERE employeeId = ''' + @employeeId + '''')
-OR-
EXEC SP_EXECUTESQL ('SELECT * FROM Employees WHERE employeeId = ''' + @employeeId + '''')

edited Aug 13, 2015 at 14:52

answered Aug 13, 2015 at 14:19

viggity

15.3k7 gold badges92 silver badges97 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user2228413 Over a year ago

Even using parameters as string?

Aron Over a year ago

@MahmutYaman Firstly, EF would be a bit crap if it had such a HUGE security hole in it. Secondly EF under the covers uses parameterized queries, which is injection safe.

viggity Over a year ago

@aron true, but EF does allow the dangerously crafted sql above. using parameters alone doesn't protect you, you need to use them correctly

Collectives™ on Stack Overflow

Sql Injection Risk at Entity Framework with Old Type Commands

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related