sql-injection

What will be the best practices in my code to prevent sql injection?

by

What will be the best practices to prevent sql injection? My client asked me to prevent sql injection. I used this structure for data inserting or updating public bool Add(GreenItem aGreenItem, Employee emp) { aGreenItem.GreenItemCode = new CommonBLL().GetMaxId("[GreenItemCode]", "[Processing].[GreenItem]", "GTM"); using (SqlConnection objConnection = Connection.GetConnection()) { SqlTransaction transaction = objConnection.BeginTransaction("SampleTransaction"); try { string query = … Read more

Avoiding SQL injection without parameters

by

We are having another discussion here at work about using parametrized sql queries in our code. We have two sides in the discussion: Me and some others that say we should always use parameters to safeguard against sql injections and the other guys that don’t think it is necessary. Instead they want to replace single apostrophes with two apostrophes in all strings to avoid sql injections. Our databases are all running Sql Server 2005 or 2008 and our code base is running on .NET framework 2.0.