Escaping SelectParameters in ASP.NET
I have the following SQLDataSource
:
<asp:SqlDataSource ID="topicSource" runat="server" ConnectionString="<%$ ConnectionStrings"
SelectCommandType="Text" SelectCommand="SELECT * FROM tbl_Topic WHERE TopicId = @TopicId">
<SelectParameters>
<asp:QueryStringParameter Name="TopicId" QueryStringField="id" />
</SelectParameters>
</asp:SqlDataSource>
Is ASP.NET a parameter select
for me? If not, what am I doing to make it safer to prevent injection?
+2
Funky dude
source
to share
1 answer
Yes: in this case, you are completely protected from SQL injection. It's all about having SQL options like this.
+2
Benjamin pollack
source
to share