Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

4
  • It's either a string or a number. A string is escaped with SafeDbString. A number is an Int32, and it can't drop databases. Commented May 26, 2009 at 13:21
  • Numbers are easier to handle. You just convert the parameter to an int/float/whatever before using it in the query. The problem is when you must accept string data. Commented May 26, 2009 at 13:21
  • Andomar - if you're just constructing a SQL statement by hand then it's intended "type" doesn't matter, you can SQL inject with a number very, very easily. Rune - I think this is relying far too much on the individual developer to remember all the nuances of manually solving SQL injection. If you just say "use parameters" it's very simple and they can't go wrong. Commented May 26, 2009 at 13:24
  • @Andomar: What about NULL? Or strings that look like numbers? Commented May 26, 2009 at 13:38