Question

I am using commandname and commandargument to control sorting (field and direction). How secure is the viewstate from SQL injection.

Answer 1

If you are passing values from the ViewState into concatenated SQL, then yes. However, if you’re using Bind Parameters (you are, aren’t you?) then you don’t have to worry about it.

Bad:

string sql = "select * from product where name = ' + ProductNameTextBox.Text + '"

Good:

string sql = "select * from product where name = @name"

using(var command = new SqlCommand(sql, connection))
{

   SqlParameter param = new SqlServerParameter("@name", SqlDbType.VarChar, 50);
   param.Value = ProductNameTextBox.Text;

   command.Parameters.Add(param);

   command.ExecuteNonQuery();
}