Will using LINQ to SQL help prevent SQL injection

c# asp.net linq linq-to-sql
Bill Martin picture Bill Martin · Jan 23, 2009 · Viewed 27.1k times · Source

I'm setting up a public site and the first thing on my mind is SQL injection. I have some text fields I'm saving and am using linq to update/write to the database. Am I safe using linq?

This example is creating the user account. 

Data.MemberRegistrationDataContext context = new MemberRegistrationDataContext();
Data.tbl_Member_UserProfile profile = new tbl_Member_UserProfile();
profile.SSN = Convert.ToDecimal(Session["tempMemberSSN_Registration"]);
profile.UserName = userName;
profile.Password = password;
profile.EmailAddress = email;
profile.QuestionID = qID;
profile.QuestionResponse = securityAnswer;
profile.LastModDt = DateTime.Now;
profile.LastModBy = "web";
context.tbl_Member_UserProfiles.InsertOnSubmit(profile);
context.SubmitChanges();

This example is changing the password

   MemberRegistrationDataContext dc = new MemberRegistrationDataContext();
   var mProfileRecord = dc.tbl_Member_UserProfiles.Single(c => c.SSN == sSSN);
   mProfileRecord.Password = sNewPassword;
   dc.SubmitChanges();

Are these safe? Does LINQ parameterize the SQL it generates automatically?

Answer

Galwegian picture Galwegian · Jan 23, 2009

Yes, LINQ will help stop SQL injection.

LINQ to SQL passes all data to the database via SQL parameters. So, although the SQL query is composed dynamically, the values are substitued server side through parameters safeguarding against the most common cause of SQL injection attacks.

Also, see Eliminate SQL Injection Attacks Painlessly with LINQ for some info.

Related questions

LINQ to SQL Where Clause Optional Criteria

I am working with a LINQ to SQL query and have run into an issue where I have 4 optional fields to filter the data result on. By optional, I mean has the choice to enter a value or not. Specifically, …

Read More
Purpose of EF 6.x DbContext Generator option when adding a new data item in Visual Studio

I have a web app that I built using LINQ to SQL and I'm looking to upgrade it to LINQ to Entity Framework. I've looked at some tutorials and what I've learned is that basically in the database-first scenario, you …

Read More
Linq row not found or changed

Error Message: Row not found or changed. Stack Trace: at System.Data.Linq.ChangeProcessor.SubmitChanges(ConflictMode failureMode) at System.Data.Linq.DataContext.SubmitChanges(ConflictMode failureMode) This occurs seemingly randomly. I get emailed these errors, and the URL reported always seems …

Read More