preventing my application from sql injection?

Question

I am making a project in which i have a login page.

i am restricting user to enter

AND OR NOT XOR & | ^

is this enough to prevent my application from SQL Injection?

Answer 1

No, not at all.

For example, I could still enter my username as:

; DELETE FROM Users --

Which could still, depending on your DB structure and application code, wipe your entire Users table.

To adequately protect yourself from SQL Injection attacks you should escape any user input and use either parameterized queries or stored procedures (and if you're using stored procedures, be sure you don't have dynamically generated SQL inside the stored procedure) to interact with the database.