I am using .NET 3.5, and looking at old code done by someone else and trying to add security and update it.
What are the best practices for accessing data in a web forms project?
Currently I am changing the code to use SQL parameterization, like so:
using (SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings[ConfigurationManager.AppSettings["defaultConnection"]].ConnectionString))
{
using (SqlCommand myCommand = new SqlCommand(sql.ToString(), conn))
{
myCommand.Parameters.AddWithValue("search1", mySearchVar);
...
I know SQL parametization is important, but I see other people using stored procedures? Is they other ways, best practices to follow?
