Question

I have the following code:

    [WebMethod]
    public static string addNewNote(string id, string txt)
    {
        Guid parentId = new Guid(id);
        DbProviderFactory dbf = DbProviderFactories.GetFactory();
        using (IDbConnection con = dbf.CreateConnection())
        {
            con.Open();
            using (IDbTransaction trn = con.BeginTransaction())
            {

                Guid noteId = Guid.Empty;
                SqlProcs.spNOTES_WebForms
                        (ref noteId,
                        parentId,
                        "Files",
                        "Client Note",
                        txt,
                        true
                        );
            }
        }
        return "";
    }

In other languages such as PHP, there exist functions such as strip_tags or addslashes or mysqlrealescapestring that would sanitize or otherwise clean client-based variables before inserting them into the database.

Do any such functions exist, or are any such functions required in C# ASP.NET. I am already using a stored procedure, as you can see.

Answer 1

If you use parametrized queries .Net will handle the variable sanitation for you.