Home/ Questions/Q 6181825
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T01:05:36+00:00

I would like to make sure when using SqlCommand that I am using best

  • 0

I would like to make sure when using SqlCommand that I am using best practices, particularly with regards to security.

Considerations that I am not sure about:

  1. Is it ok to manually build the string by appending? If not, how should I do it?
  2. What classes should I be looking at using instead?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If your first question is talking about building SQL by including the values directly, that’s almost certainly not okay. It opens you up to SQL injection attacks, as well as issues with conversions (e.g. having to get the right date/time format).

    Instead, you should use a parameterized query, and set the values in the parameters. See the docs for SqlCommand.Parameters for an example.

    Out of interest, do you have a particular reason for using SQL directly instead of using one of the many ORMs around? (LLBL, Entity Framework, NHibernate, LINQ to SQL, SubSonic, Massive, SimpleData, Dapper…)

    • 0