Question

I am developing an ASP.Net MVC 3 application using Entity Framework 4.1. For one of queries I am taking advantage of the SqlQuery method on the DbSet class which enables me to execute a raw SQL query that returns an entity list.

I have a method within my Service class, see below, where I write the raw sql and pass in two parameters, shiftID and shiftDateID.

public IList<User> GetAvailableLocums(int shiftID, int shiftDateID)
{
   var query = @"set language 'British'

   SELECT   *
   FROM     [Shift]
   WHERE    shiftID = @p0
   AND      shiftDateID = @p1";

   return _UoW.User.GetWithRawSql(query, shiftID, shiftDateID).ToList();

}

I then call the following method in my Repository class, see below,

public IEnumerable<TEntity> GetWithRawSql(string query, params object[] parameters)
{
     return dbSet.SqlQuery(query, parameters).ToList();
}

I am worried that this might be open to a SQL Injection attack. If so, does anyone know how I can parametrize my two parameters?

Thanks for your help.

Answer 1

Have you seen this http://msdn.microsoft.com/en-us/library/bb738521.aspx? Second code block..