Escaping SelectParameters in ASP.NET

I have the following SQLDataSource

:

<asp:SqlDataSource ID="topicSource" runat="server" ConnectionString="<%$ ConnectionStrings" 
        SelectCommandType="Text" SelectCommand="SELECT * FROM tbl_Topic WHERE TopicId = @TopicId">
        <SelectParameters>
            <asp:QueryStringParameter Name="TopicId" QueryStringField="id" />
        </SelectParameters>
    </asp:SqlDataSource>

      

Is ASP.NET a parameter select

for me? If not, what am I doing to make it safer to prevent injection?

+2


source to share


1 answer


Yes: in this case, you are completely protected from SQL injection. It's all about having SQL options like this.



+2


source







All Articles