Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Do Entity Framework functions automatically escape input to protect against injection?
In my SQL DB layer, I have a SPROC that takes an nvarchar(max) as input.
In my EDMX, the SPROC is mapped to a function import as methodName(string input)
Do I need to manually escape the input to protect against injection or does Entity Framework do this automatically?
Depends…
EF does escape inputs for you so you are safe in most cases.
But if you create dynamic SQL inside the procedure with the inputs or calling another function or procedure with the inputs, you are still subject to SQL Injection attack.
To prevent SQL Injection, one has to follow to the last part of execution path and make sure the inputs are validated.