Need to double inverted commas if using parameters?

  • Thread starter Thread starter Jon Maz
  • Start date Start date
J

Jon Maz

Hi,

A quick one:

If you are forming a dynamic sql statement using parameters from a web form,
you would normally double up any single inverted commas inputted by the user
to stop sql injection. But if you are using command parameters to build the
sql statement (as below), is this still necessary?

cmd.Parameters.Add("@subcategory", SqlDbType.VarChar).Value =
subcategory;

TIA,

JON


PS First posted to aspmessageboard
http://www.aspmessageboard.com/forum/aspplus.asp?M=671672&T=671672&F=36&P=1 - no answers yet
 
No, it isn't.

Jon Maz said:
Hi,

A quick one:

If you are forming a dynamic sql statement using parameters from a web form,
you would normally double up any single inverted commas inputted by the user
to stop sql injection. But if you are using command parameters to build the
sql statement (as below), is this still necessary?

cmd.Parameters.Add("@subcategory", SqlDbType.VarChar).Value =
subcategory;

TIA,

JON


PS First posted to aspmessageboard
Click to expand...
http://www.aspmessageboard.com/forum/aspplus.asp?M=671672&T=671672&F=36&P=1 - no answers yet
 
IIRC, command parameters handle single quotes automatically, unlike full SQL
statements, which require doubling up single quotes.

Hi,

A quick one:

If you are forming a dynamic sql statement using parameters from a web form,
you would normally double up any single inverted commas inputted by the user
to stop sql injection. But if you are using command parameters to build the
sql statement (as below), is this still necessary?

cmd.Parameters.Add("@subcategory", SqlDbType.VarChar).Value =
subcategory;

TIA,

JON


PS First posted to aspmessageboard
Click to expand...
http://www.aspmessageboard.com/forum/aspplus.asp?M=671672&T=671672&F=36&P=1 - no answers yet
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How do you get output parameters? 4
Error sql parameter SqlDbType.Float won't accept null value, AND/OR variable as DOUBLE won't accept 4
Using Output Parameters from SQL Server Stored Procedure to ASP.NET SQLCommand 1
Porting from JScript to JScript.Net - compiler error 4
Using ISAPI filter with .net for URL Rewriting 2
Using "double equal signs" in place of an IF statement 2
VB.NET passing CLOB input parameter to Oracle stored function 0
Why no input parameters for combo box rowsource? 2

Back
Top