Inserting into DB with parameters safe from SQL injection?

Question

I been reading a bit about SQL injection and I want to be sure my code is lets say "safe" from it, I was planning on using RegExp validators to check the user input but another post in here suggested only using parametrized querys, well I'm using them but I want to be sure my code is safe, is it?

        using ( SqlConnection dataConnection = new SqlConnection(myConnectionString) )
        {
            using ( SqlCommand dataCommand = dataConnection.CreateCommand() )
            {
                dataCommand.CommandText = "INSERT INTO Lines (Name, CreationTime) " +
                    "VALUES (@LineName, @CurrentDateTime)";

                dataCommand.Parameters.AddWithValue("@LineName", TextBox2.Text);
                dataCommand.Parameters.AddWithValue("@CurrentDateTime", DateTime.Now.ToString());
                dataConnection.Open();
                //do other DB stuff

I chop the last part to make the post shorter, the rest is just trying and catching exceptions and closing db connection as well as providing user feedback on inserting successful.

If the CreationTime column is of type DateTime, you don't need the .ToString() cast. — Cosmin
– Cosmin, Commented Mar 15, 2011 at 18:41

Ta01 · Accepted Answer · 2011-03-15 18:09:51Z

12

Your code is fine, it is protected from injection because the values are passed as parameters not string literals. However, if you are writing this type of data access yourself, have you considered creating SqlParameter objects and explicitly setting the type, size etc, and adding the parameters to the command? AddWithValue will work just fine, but SQL Server will have to determine the type, a little, but unnecessary overhead.

answered Mar 15, 2011 at 18:09

Ta01

31.7k13 gold badges74 silver badges100 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Termiux Over a year ago

I had, but I didnt knew that it will be a little better in the perfomance part if I did, guess I will be doing that now. U think that is still necessary to use the RegExp validator?

Ta01 Over a year ago

A Regex Validator for the user input that will be passed as parameters?

Andy Wiesendanger · Accepted Answer · 2011-03-15 18:07:31Z

1

Well, you could always try to inject a SQL statement into the textbox, that will probably give you a quicker, definite answer.

answered Mar 15, 2011 at 18:07

Andy Wiesendanger

6439 silver badges17 bronze badges

Comments

Pete M · Accepted Answer · 2011-03-15 18:10:28Z

1

Yes, that's reasonably safe. So long as you don't use "sanitized" variables from a prepared statement to generate dynamic sql later, you're usually ok. The fact that you're using a prepared statement will take care of dealing with escape characters and other simple methods of injection.

I wouldn't forgo any other validation though...

answered Mar 15, 2011 at 18:10

Pete M

2,04811 silver badges17 bronze badges

2 Comments

Termiux Over a year ago

Like what? besides checking for empty fields, should I check for anything else?

Pete M Over a year ago

What kind of input do you expect to receive? Check for anything that doesn't make sense. I'm a big fan of client side AND server side validation THEN using parameterized/prepared statements. If nothing else I'd like to see when people are trying to give me garbage, even if it's unlikely they'll be successful.

Collectives™ on Stack Overflow

Inserting into DB with parameters safe from SQL injection?

3 Answers 3

2 Comments

Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

2 Comments

Linked

Related