Please refer following database search tutorial and advise if search methodology is safe, especially since it is taking input from a textbox.
http://net.tutsplus.com/tutorials/asp-net/enabling-search-functionality-in-your-site-using-the-new-features-in-aspnet-35/
Protected Sub btnSubmit_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnSubmit.Click
Dim db As New BlogDBDataContext()
Dim q = From b In db.Blogs _
Where b.BlogContents.Contains(txtSearch.Text.Trim()) Or _
b.BlogTitle.Contains(txtSearch.Text.Trim()) _
Select b
lv.DataSource = q
lv.DataBind()
End Sub
Yes, that's safe. You aren't at risk from SQL injection attacks using LINQ unless you create the SQL yourself, for example if you use ExecuteQuery.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With