开发者

Escaping SelectParameters in ASP.NET

I have the following SQLDataSource:

<asp:SqlDataSource ID="topicSource" runat="server" ConnectionString="<%$ ConnectionStrings" 
        SelectCommandType="Text" SelectCommand="SELECT * FROM tbl_Topic WHERE TopicId = @TopicId">
        <SelectParameters>
    开发者_运维技巧        <asp:QueryStringParameter Name="TopicId" QueryStringField="id" />
        </SelectParameters>
    </asp:SqlDataSource>

Does ASP.NET escape the select parameter for me? If not, what do I do to make it safer to prevent injections?


Yes: in this case, you are fully protected from SQL injection. That's the whole point for having SQL parameters in this fashion.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜