Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is this LINQ based search safe against SQL injection / XSS attack?

Please refer following database search tutorial and advise if search methodology is safe, especially since it is taking input from a textbox.

http://net.tutsplus.com/tutorials/asp-net/enabling-search-functionality-in-your-site-using-the-new-features-in-aspnet-35/

Protected Sub btnSubmit_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnSubmit.Click  

    Dim db As New BlogDBDataContext()  

    Dim q = From b In db.Blogs _  
            Where b.BlogContents.Contains(txtSearch.Text.Trim()) Or _  
                  b.BlogTitle.Contains(txtSearch.Text.Trim()) _  
            Select b  

    lv.DataSource = q  
    lv.DataBind()
End Sub  
like image 324
Pradeep Kalugade Avatar asked Oct 04 '11 09:10

Pradeep Kalugade


1 Answers

Yes, that's safe. You aren't at risk from SQL injection attacks using LINQ unless you create the SQL yourself, for example if you use ExecuteQuery.

like image 59
Mark Byers Avatar answered Sep 27 '22 17:09

Mark Byers