Parameterized queries are the only method to avoid sql injection?

Question

Is there a method (specially using ASP.net tools) to avoid sql injection other than parameterized queries?

Look at using an ORM I suppose... But even those will just do it for you... — sgeddes, Feb 04 '13 at 02:43
There is a dll antixssLibrary available you should be using that — शेखर, Feb 04 '13 at 04:44
here is a link http://stackoverflow.com/questions/2022289/why-use-microsoft-antixss-library — शेखर, Feb 04 '13 at 04:46
@krshekhar, that´s what I was looking for, an ASP.net tool, in this case the Anti XSS Library, to filter my user inputs. Although it seems to be pretty useful for more than just SQL queries. — Omareo, Feb 09 '13 at 06:20

score 0 · Answer 1 · answered Feb 04 '13 at 02:46

one of the simplest method is what I call sanitization. Just Replace( vsInputString, "'", "''") while constructing the SQL statement:

Dim vsSQLStatement = "SELECT * FROM table01 WHERE myField = '" & Replace(vsFormTextInput, "'", "''" ) & "';"

will also help stop SQL injection.

score 0 · Accepted Answer · answered Feb 04 '13 at 15:12

Yes, of course. Other than parameterized queries, you should also consider these:

Using stored procedures
Using a limited access account to connect to the database (not admin level)
Encrypt the ConnectionString and other sensitive data
Set debug=false (in customError) to minimize the information in the event of error

I hope it helps you.

2 Answers2