Injection safe call to IAxaptaRecord.ExecuteStmt()

Question

Is there an injection safe way to call via the axpata business connector

string salesId = someObject.Text;

IAxaptaRecord salesLine = ax.CreateRecord(\"SalesLine         


        

Answer 1

There is no way to be sure you have covered all cases ...

Using ExecuteStmt is most likely the wrong approach. You should write your select or whatever in an Axapta method (with parameters) then call that method.

Answer 2

you should do a replace on ' to \' e.g.

string salesId = someObject.Text.Replace("'", "\\'");