Question

I usually use sql parameters with queries, but in this case I need to dynamically create more than just the parameters.

Could someone use injection on any of the variables? Aside from a stored procedure is there a simple way to protect against injection via code?

string whereClause = "WHERE " + filter.ToString() + " > " + nextStartPoint;
string orderBy = "ORDER BY " + filter.ToString() + " DESC";   

ex

string sql = "SELECT TOP(" + numItemsToGet + ") * " +
                                 "FROM Items " +
                                  whereClause + " " +
                                  orderBy;

Update

filter.ToString() is the actual column name

I’m surprised the following worked (partial ex)… I also thought you have to reference a column name with sql parameters.

cmd.Parameters.AddWithValue("Count", 10);

                    string sql = "SELECT TOP(@Count) * " +

Answer 1

Yes this is definitely subject to injection. If the user controls the filter parameter then it’s very easy for them to inject bad SQL into your statement.

The simplest way to prevent an injection attack is to use SqlCommand to build up your command. It’s designed to help prevent such attacks and will take the appropriate steps to protect your input