Linq to SQL and SQL Injection

Question

What do I need to add, if I need to at all, to avoid sql injections?

public static Login GetLoginByName(string name)
{
    var context=new telephonyEntities1();

    Login t = (from l in context.Logins
               where l.login1==name
               select l).FirstOrDefault();
    return t;
}

jeroenh · Accepted Answer · 2011-05-05 06:58:21Z

6

Linq-to-sql uses SqlParameter to generate SQL queries, so no you do not need to do anything extra.

From Frequently Asked Questions (LINQ to SQL)

Q. How is LINQ to SQL protected from SQL-injection attacks?

A. SQL injection has been a significant risk for traditional SQL queries formed by concatenating user input. LINQ to SQL avoids such injection by using SqlParameter in queries. User input is turned into parameter values. This approach prevents malicious commands from being used from customer input.

answered May 5, 2011 at 6:58

jeroenh

26.9k11 gold badges77 silver badges107 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Linq to SQL and SQL Injection

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related