Escaping SelectParameters in ASP.NET
I have the following SQLDataSource
:
<asp:SqlDataSource ID="topicSource" runat="server" ConnectionString="<%$ ConnectionStrings"
SelectCommandType="Text" SelectCommand="SELECT * FROM tbl_Topic WHERE TopicId = @TopicId">
<SelectParameters>
<asp:QueryStringParameter Name="TopicId" QueryStringField="id" />
</SelectParameters>
</asp:SqlDataSource>
Is ASP.NET a parameter select
for me? If not, what am I doing to make it safer to prevent injection?
+2
source to share