Creating database in C# and SQL injection

Question

I have the following code used to create some database from C# application

SqlConnection myConnection = new SqlConnection(ConnectionString);
string myQuery = "CREATE DATABASE " + tbxDatabase.Text; //read from textbox
myConnection.Open();
SqlCommand myCommand = new SqlCommand(myQuery, myConnection);
myCommand.ExecuteNonQuery();

Now I worry if it is safe, will C# accept hacker input like "A; DROP TABLE B" or something similar? How to make it safer?

Answer 1

Table Names and columns names cannot be parameterized but for the first line of defense, wrap the tablename with delimiter such as braces,

string myQuery = "CREATE DATABASE [" + tbxDatabase.Text + "]";

or create a user define function that checks for the value of the input, eg

private bool IsValid(string tableName)
{
    // your pseudocode
    // return somthing
}

then on your code,

if (IsValid(tbxDatabase.Text))
{
    SqlConnection myConnection = new SqlConnection(ConnectionString);
    string myQuery = "CREATE DATABASE [" + tbxDatabase.Text + "]";
    myConnection.Open();
    SqlCommand myCommand = new SqlCommand(myQuery, myConnection);
    myCommand.ExecuteNonQuery();
}
else
{
    // invalid name
}