Preventing SQL Injection on ASP.NET Web Application

Validation (checking for things like quotes etc) is never required in these examples, and should never be used (except for a few cases, where white-listing might be appropriate).

What is required is parameterisation. Use parameters instead of concatenation.

SqlBulkCopy handles the data directly, so that is fine, however:

SqlConnection conn = new SqlConnection("<datasource>");
string sql = string.Format("INSERT INTO [UserData] (Username, Password, Role, Membership, DateOfReg) VALUES ('" + un.Text + "', '" + pw.Text + "', '" + role.Text + "', '" + ms.Text + "', '" + dor.Text + "')"); --> all *.Text are textboxes on the webpage

SqlCommand cmd = new SqlCommand(sql, conn);
    conn.Open();
    cmd.ExecuteNonQuery();
    conn.Close();

is just asking to be abused horribly. YOUR SYSTEM IS BROKEN. You should have something like:

cmd.CommantText = "INSERT INTO [UserData] (Username, ...) VALUES (@username, ...)";
cmd.Parameters.AddWithValue("Username", un.Text);
...

or any of the other ways of adding parameters.

your example 4 is an interesting one, which is an example of where white-listing might be appropriate; SQL Server does not allow you to parameterise the column name, but you cannot trust the value coming up from the client. If you need that kind of "choose the column based on input", you must test it against the expected values:

string[] allowedColumns = new[] {"Name", "Description", "Foo", "Bar"};
string colName = ...
if(!allowedColumns.Contains(colName)) colName = allowedColumns[0]; // DENIED!

Once you have white-listed the column against expected values, you now know that the value is not "] where 1=1 drop table Users drop table Customers --"

However! the search value should be parameterised, i.e.

`... LIKE @searchValue`

where the searchValue parameter is given the value "%" + something.Text + "%"

Create SqlCommand and pass the data as SqlParameter will do the task for you

MSDN : SqlCommand.Parameters Property

private static void UpdateDemographics(Int32 customerID,
    string demoXml, string connectionString)
{
    // Update the demographics for a store, which is stored 
    // in an xml column. 
    string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
        + "WHERE CustomerID = @ID;";

    using (SqlConnection connection = new SqlConnection(connectionString))
    {
        SqlCommand command = new SqlCommand(commandText, connection);
        command.Parameters.Add("@ID", SqlDbType.Int);
        command.Parameters["@ID"].Value = customerID;

        // Use AddWithValue to assign Demographics.
        // SQL Server will implicitly convert strings into XML.
        command.Parameters.AddWithValue("@demographics", demoXml);

        try
        {
            connection.Open();
            Int32 rowsAffected = command.ExecuteNonQuery();
            Console.WriteLine("RowsAffected: {0}", rowsAffected);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }
}

The very easiest way is inputting the parameters into the sql command instead of passing it directly. The .net and Sql will take care of the data types passed, if you pass the values through parameters.

For Example see the following:

SelectCommand.CommandText = "Select * From [UserData] where ColumnValue like  @RowValue";
SelectCommand.Parameters.AddWithValue("@RowValue","% ActualRowValue %");

You can add the parameters using the markup. Refer to the asp:SqlDataSource select command with parameters