StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
1855872
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
1
CommunityOwnedDate
CreationDate
2009-12-06T16:56:56.817
FavoriteCount
0
LastActivityDate
2009-12-06T16:56:56.817
LastEditDate
LastEditorUserId
0
OwnerUserId
87698
ParentId
1855661
PostTypeId
2
Score
1
ViewCount
0
LastEditorDisplayName
text
Body
I think you are fine: According to the <a href="http://msdn.microsoft.com/en-us/library/ms175055.aspx" rel="nofollow noreferrer">SQL Server Books Online</a>, a solitary single quote seems to be the only way to exit a quoted string that was started with a single quote. Thus, replacing <code>'</code> with <code>''</code> should suffice to avoid SQL injection through <code>string</code> variables. I cannot think of any way to inject SQL through other, non-string native C# data types, if they are properly (locale-invariant) converted to strings. Nevertheless, parameterized queries are the "recommended" solution. At the moment, your application seems to be organized like this: <ol> <li>Part A creates a WHERE statement based on user input.</li> <li>A string containing this WHERE statement is passed to Part B.</li> <li>Part B adds SELECT etc. and sends it to SQL Server.</li> </ol> Would it be an option to rewrite your application like this? <ol> <li>Part A creates a parameterized WHERE statement plus a set of parameters based on user input.</li> <li>A string containing the WHERE statement plus a Hashtable (or something similar) containing the parameters is passed to Part B.</li> <li>Part B creates a command, adds SELECT etc., adds the parameters and sends it to SQL Server.</li> </ol> I was in a similar situation and solved it by creating a <code>SubSQL</code> class, which basically contains a parameterized string with the CommandText and a hash table with the parameters. You could then use this as <code>mySubSQL.CommandText += ...</code>, <code>mySubSQL.Parameters("@myfield") = myValue</code> and <code>mySubSQL.MergeInto(myCommand)</code> (the implementation should be obvious and straight-forward).
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POBuild safe search conditions for SQL WHERE clause
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USHeinzi
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId
1. CORewrite the application to use parameterized queries is not an option unfortunately. My .Net application has to feed queries into SugarCRM's SOAP API (written in PHP). The best I can do so far is simply be very strict with what can be passed into my code. For example if I am looking for user by email address using SOAP API I must make sure the string passed to me by caller is in fact an email address, if I am looking for a product SKU make sure it's alphanumeric etc. Thanks for the help though!
 singulars
 PostPostId
 PO
 UserUserId
 USLeffeBrune

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.