Question

I’m currently writing an application which uses ajax on the front end and ASP.NET (C#) on the back end..

A Small Part of the application does an AJAX call to the backend code (to get entries from the SQL database)

How can i prevent SQL of JScript injection?

I know it is generally unsecure to validate with javascript because javascript can be turned off but as this is an AJAX call so if the user has javascript turned off the AJAX will never run.

Whats the best way of validating or escaping the input?

Like Add_Slashes() in PHP?

Thanks

Daniel

Answer 1

Use parametrized queries, never build SQL code strings.