Question

I have a quick question with regards to preventing SQL injection in my application.

Two different features of my web application use textboxes that a user can use to search for items from a MSSQL database. This information is displayed in a GridView.

I create the queries by using this method:

sqldatasource.SelectCommand = "SELECT x from x where this_id LIKE '%" + txtbox.Text + "%' ORDER BY x ASC";

Obviously taking user input and entering it straight into a query like this will open it up to basic SQL injection. Please could someone explain how I can parametrise this to prevent SQL injection in my application?

Thanks in advance

Answer 1

Thanks for your answers. In the end I used this from the MSDN site on parametrised queries:

    GetSubInfo.SelectParameters.Add("xparam", txtbox.Text);
    GetSubInfo.SelectCommand = "SELECT x from x where x_id LIKE @xparam ORDER BY x ASC";

This is very similar to Hogan’s answer, with slightly different syntax. Hope this helps!