Will using LINQ to SQL help prevent SQL injection

Question

I\'m setting up a public site and the first thing on my mind is SQL injection. I have some text fields I\'m saving and am using linq to update/write to the database. Am I sa

Answer 1

You're good to go. Linq does parameterize the data it sends to the database.

Use the Log property to check out what's happening: dc.Log = Console.Out;

Answer 2

It should because the SQL emitted uses named parameters which cannot be exploited to execute arbitrary SQL.

Answer 3

Yes, LINQ will help stop SQL injection.

LINQ to SQL passes all data to the database via SQL parameters. So, although the SQL query is composed dynamically, the values are substitued server side through parameters safeguarding against the most common cause of SQL injection attacks.

Also, see Eliminate SQL Injection Attacks Painlessly with LINQ for some info.