infopath query and sql injection problem

How 开发者_StackOverflow中文版can I protect my site from sql injection when Im getting ?details = value

from url

and the looking for the object in xml column in database with specified value ?

here is sample code:

sqlQuery = string.Format(@"
                    SELECT 
                        [data]

                    FROM " + schema + @".[MyOBjects] 
                    WHERE 

                        " data.exist('/data["theValue"=\"{0}\"]') = 1" + 



                    ", property, value);

Thanks for any help

Check out the following article about protecting your code from SQL injection: Protect From SQL Injection in ASP.NET

In your case you may want to look into using parameterized queries. Checkout "Step 3. Use Parameters with Dynamic SQL".

You could use something similar to this:

string connectionString = "...";
string schema = "...";
string value = "...";

using (SqlConnection connection = new SqlConnection(connectionString))
{
    string sql = string.Format("SELECT [data] FROM {0}.[MyOBjects] WHERE data.exist('/data[\"theValue\"=sql:variable(\"@value\")]') = 1", schema);

    SqlCommand sqlCommand = new SqlCommand(sql, connection);
    sqlCommand.CommandType = System.Data.CommandType.Text;
    sqlCommand.Parameters.Add(new SqlParameter("@value", System.Data.SqlDbType.NVarChar, 255) { Value = value });

    ....
}

Use a stored procedure in the database, and instead of passing the values directly into the query pass them to the stored procedure. If you really need the table name to be dynamic, there are methods out there for doing it.

Here's one for example: http://www.nigelrivett.net/SQLTsql/TableNameAsVariable.html