This is a simple query I have written. What would be the best way to paramaterize this to prevent SQL injection?
string selectQuery = "select [ID] from [myDB].[dbo].[myTable] where [myName] = '" + user.globalUserName + "'";
Add a comment
|
1 Answer
You can use the @ to define a parameter, like this:
string selectQuery = "select [ID] from [myDB].[dbo].[myTable] where [myName] = @username;";
Then you can define the parameter by using the Command.Parameters Function, like this:
cmd.Parameters.Add("@username", SqlDbType.VarChar);
cmd.Parameters["@username"].Value = user.globalusername;
or like this:
cmd.Parameters.AddWithValue("@Username", user.globalusername);
1 Comment
codeBoy
Ben, with this i get "Must declare the scalar variable" for username. I am using the "or like this" option