Validate Post Data in ASP.NET MVC

Question

I have this controller method below:

[HttpPost]
public ActionResult Login(UserDetails userdetails)

What did I do so far ?

Replaced potential SQL Candidates in my form (via JQuery side , eg. replace '&' by 'amp')
I have added ModelState.IsValid() in ServerSide to check.

Are these two checks enough or How should I make sure that userDetails.UserName is free from Injected SQL ? (Like 1=1 SQL Injection attacks)

How do you plan to access database - ADO.NET or ORM like EF or Dapper? — Win
– Win, Commented Sep 7, 2018 at 20:52
it is generally recommended to not try these on your own. Just let the frameworks built for this, to do this for you. These are built for years do perform these tasks. — Neville Nazerane
– Neville Nazerane, Commented Sep 8, 2018 at 0:09

Roman Svitukha · Accepted Answer · 2018-09-07 19:53:41Z

1

Using Entity Framework, Dapper or regular parameterized query should be sufficient enough.

answered Sep 7, 2018 at 19:53

Roman Svitukha

1,4021 gold badge14 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

now he who must not be named. Over a year ago

I'm already using Entity framework. Does it mean, EF is free from SQL Injection Attacks altogether ?

Roman Svitukha Over a year ago

Yes if you are using parameterized queries or LINQ. Although query composition is possible in LINQ to Entities, it is performed through the object model API. Unlike Entity SQL queries, LINQ to Entities queries are not composed by using string manipulation or concatenation, and they are not susceptible to traditional SQL injection attacks. (ref :learn.microsoft.com/en-us/dotnet/framework/data/adonet/ef/…)

Collectives™ on Stack Overflow

Validate Post Data in ASP.NET MVC

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related