Sql Injection Attacks and Subsonic

Question

If I use SubSonic to create DAL for my web project do I need to worry about preventing SQL Injection Attacks?

Answer 1

This depends on how you construct your queries. It is totally possible to write unsafe queries with subsonic if you don't use parameters.

// Bad example:

string sql = "delete from Products where ProductName = " + rawUserInput;
QueryCommand qry = new QueryCommand(sql, Product.Schema.Provider.Name);
DataService.ExecuteQuery(qry);

// Should be:

string sql = "delete from Products where ProductName = @TargetName";
QueryCommand qry = new QueryCommand(sql, Product.Schema.Provider.Name);
qry.AddParamter("@TargetName", rawUserInput, DbType.String);
DataService.ExecuteQuery(qry);