Is IQueryable SQL injection proof using Entity Framework?

Question

I know that if I use linq to sql, everything will be parametrised and sql injection safe. But how about IQueryable?

For example, I can cast some entity to Iqueryable:

var myquery = mytesttable.AsQueryable();
var qText = "name="+ "\""+DynamicSearchCondition+ "\"";
myquery = myquery.Where(qText);

Then when the query is run, from trace I can see that the DynamicSearchCondition passed in is not parametrised.

Initially I thought this is not sql injection proof, but I then tried some examples, and just can't break this one. Does it mean it is sql injection free then (I think it is now)?

If that is true, will it mean all IQueryable are sql injection safe?

Answer 1

Absolutely it is vulnerable to injection attacks.

For your particular example:

var myquery = mytesttable.AsQueryable();
var qText = "name="+ "\""+DynamicSearchCondition+ "\"";
myquery = myquery.Where(qText);

would fail with this:

var DynamicSearchCondition= "\" or \"\"=\"";