C# Linq to SQL is contains safe for sql injections

Question

Generally I know that Linq to SQL is safe for SQL Injections because it is using SqlParameter (as explained here and also here).

But how does it look like for contains:

StreetRepository.Streets.Where(w => w.Streetname.Contains("Road"))

If I log the queries in SQL Server directly, I can see that following query is used:

SELECT [Extent1].[Id] AS [Id], [Extent1].[Streetname] AS [Streetname] 
FROM [dbo].[Streets] AS [Extent1]  
WHERE [Extent1].[Streetname] LIKE N'%Road%'

As we can see it is not using parameters for this query. If I'm using following command:

StreetRepository.Streets.Where(w => w.Streetname.Contains("Road' OR 1=1"))

I get:

SELECT [Extent1].[Id] AS [Id], [Extent1].[Streetname] AS [Streetname] 
FROM [dbo].[Streets] AS [Extent1]  
WHERE [Extent1].[Streetname] LIKE N'%Road'' OR 1=1%'

In this case it is escaped by a double ''.

But is this safe enough for all attacks? Can I use contains without worries? If not what can I use instead of contains?

@meysamasadi have you read any line of my question? Your link doesn't answer any of my questions. — Phoniex
– Phoniex, Commented Feb 4, 2021 at 11:12
I know what you are saying. But linq reduces the risk of injection. i tested Contains("Road' OR 1=1") It was safe — persian-theme
– persian-theme, Commented Feb 4, 2021 at 11:26
Does this answer your question? Will using LINQ to SQL help prevent SQL injection — Drag and Drop
– Drag and Drop, Commented Feb 4, 2021 at 12:22
this is the same link as @meysamasadi posted... as described in all the links (posted in my question and yours) they are speaking about that parameters are used, which are safe by default. As you can see in my question the resulting SQL command doesn't have any parameters ==> because of that you link doesn't help, there is no explaination about safety when no parameters are used. Have look at accepted anwers, it explains that strings are escaped safely by LINQ. — Phoniex
– Phoniex, Commented Feb 4, 2021 at 12:35

Svyatoslav Danyliv · Accepted Answer · 2021-02-04 11:28:08Z

2

Parameters is not only way to protect from SQL Injection. LINQ to SQL knows how to properly escape strings. So do not worry, everything will be ok.

Anyway if you prefer parameters, just put string value into local variable:

var streetName = "Road";
StreetRepository.Streets.Where(w => w.Streetname.Contains(streetName));

answered Feb 4, 2021 at 11:28

Svyatoslav Danyliv

28.2k4 gold badges24 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

C# Linq to SQL is contains safe for sql injections

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related