Does LINQ's ExecuteCommand provide protection from SQL injection attacks?

后端 未结 2 854
执念已碎
执念已碎 2020-12-18 21:08

I\'ve got a situation where I need to use LINQ\'s ExecuteCommand method to run an insert.

Something like (simplified for purposes of this question):

         


        
2条回答
  •  谎友^
    谎友^ (楼主)
    2020-12-18 22:02

    LINQ to SQL uses exec_sql with parameters, which is much safer than concatenating into the ad-hoc query string. It should be as safe againt SQL injection as using SqlCommand and its Paramaters collection (in fact, it's probably what LINQ to SQL uses internally). Then again, how safe is that?

提交回复
热议问题