What is wrong with my attempt to use EntityFramework to execute a sql statement [duplicate]

Question

The following works:

var s = string.Format("drop table {0};", tableName);
context.Database.ExecuteSqlCommand(s);

But to avoid injection I'm trying to use the parameter version

context.Database.ExecuteSqlCommand(@"drop table {0};", tableName);

however this is giving me an error "Incorrect syntax near '@p0'."

I've tried ? as well, but I get similar results.

What is the source of tableName? and what is the reason for this requirement? — Martin Smith
– Martin Smith, Commented Jan 24, 2014 at 23:42

Martin Smith · Accepted Answer · 2014-01-24 23:31:09Z

1

The table name can't be parameterised.

To avoid injection the best you can do is emulate the TSQL QUOTENAME function. Ensure the table name is no longer than 128 characters. Wrap it in [] and replace any embedded ] with ]].

Executing a DROP TABLE based on arbitrary user input sounds highly unusual/problematic in itself though.

answered Jan 24, 2014 at 23:31

Martin Smith

457k97 gold badges777 silver badges887 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

What is wrong with my attempt to use EntityFramework to execute a sql statement [duplicate]

1 Answer 1

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Linked

Related