Question

What’s the ASP.NET equivalent of this PHP code?

$db = new mysqli(/*some data*/);
$db->query('INSERT INTO `log` (`msg`) VALUES ("'.$db->real_escape_string($_POST['mesg']).'");');

Im only interested in mysqli_real_escape_string, but the only examples I can find on Google for ASP.NET and SQL are all injectable.

So my question is: How do I pass user data to SQL in ASP.NET using ADO.NET?

If you use replace of regex, please base your example on this code.

Answer 1

When using this approach, you’ll want to look into using parameterized SQL in your code.

using (SqlConnection connection = new SqlConnection(connectionString))
{
  DataSet userDataset = new DataSet();

  SqlDataAdapter myDataAdapter = new SqlDataAdapter("SELECT * FROM Log WHERE Message = @Message", connection);                

  myCommand.SelectCommand.Parameters.Add("@Message", SqlDbType.VarChar, 11);

  myCommand.SelectCommand.Parameters["@Message"].Value = messageString;

  myDataAdapter.Fill(userDataset);
}