Home/ Questions/Q 700989
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T03:33:34+00:00

Plain-vanilla NHibernate setup, eg, no fluent NHibernate, no HQL, nothing except domain objects and

  • 0

Plain-vanilla NHibernate setup, eg, no fluent NHibernate, no HQL, nothing except domain objects and NHibernate mapping files. I load objects via:

_lightSabers = session.CreateCriteria(typeof(LightSaber)).List<LightSaber>();

I apply raw user input directly to one property on the “LightSaber” class:

myLightSaber.NameTag = "Raw malicious text from user";

I then save the LightSaber:

session.SaveOrUpdate(myLightSaber);

Everything I’ve seen says that yes, under this situation you are immune to SQL injection, because of the way NHibernate parameterizes and escapes the queries under the hood. However, I’m also a relative NHibernate beginner so I wanted to double-check.

Thanks!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Yes, you’re almost immune to SQL injection when using NHibernate. It uses parameterized queries for all generated SQL statements on all platforms that support these.

    You can, however, circumvent this by using custom SQL for insertions/updates, or by executing SQL with a variation of execute_sql of some sort, or SQL Queries without parameters.

    • 0