使用 LINQ to SQL 是否有助于防止 SQL 注入 [英] Will using LINQ to SQL help prevent SQL injection

问题描述

我正在建立一个公共站点，我想到的第一件事就是 SQL 注入.我正在保存一些文本字段，并且正在使用 linq 更新/写入数据库.我使用 linq 安全吗?

此示例正在创建用户帐户.

Data.MemberRegistrationDataContext context = new MemberRegistrationDataContext();Data.tbl_Member_UserProfile profile = new tbl_Member_UserProfile();profile.SSN = Convert.ToDecimal(Session["tempMemberSSN_Registration"]);profile.UserName = 用户名；profile.Password = 密码；profile.EmailAddress = 电子邮件；profile.QuestionID = qID;profile.QuestionResponse = securityAnswer;profile.LastModDt = DateTime.Now;profile.LastModBy = "web";context.tbl_Member_UserProfiles.InsertOnSubmit(profile);context.SubmitChanges();

这个例子是修改密码

 MemberRegistrationDataContext dc = new MemberRegistrationDataContext();var mProfileRecord = dc.tbl_Member_UserProfiles.Single(c => c.SSN == sSSN);mProfileRecord.Password = sNewPassword;dc.SubmitChanges();

这些安全吗?LINQ 是否参数化了它自动生成的 SQL?

解决方案

是的，LINQ 将有助于阻止 SQL 注入.

<块引用>

LINQ to SQL 将所有数据传递给数据库通过 SQL 参数.所以，尽管 SQL 查询是组成的动态地，值被替换服务器端通过参数防范最常见的SQL注入攻击的原因.

此外，请参阅使用 LINQ 轻松消除 SQL 注入攻击，了解一些信息.>

I'm setting up a public site and the first thing on my mind is SQL injection. I have some text fields I'm saving and am using linq to update/write to the database. Am I safe using linq?

This example is creating the user account.

Data.MemberRegistrationDataContext context = new MemberRegistrationDataContext();
Data.tbl_Member_UserProfile profile = new tbl_Member_UserProfile();
profile.SSN = Convert.ToDecimal(Session["tempMemberSSN_Registration"]);
profile.UserName = userName;
profile.Password = password;
profile.EmailAddress = email;
profile.QuestionID = qID;
profile.QuestionResponse = securityAnswer;
profile.LastModDt = DateTime.Now;
profile.LastModBy = "web";
context.tbl_Member_UserProfiles.InsertOnSubmit(profile);
context.SubmitChanges();

This example is changing the password

   MemberRegistrationDataContext dc = new MemberRegistrationDataContext();
   var mProfileRecord = dc.tbl_Member_UserProfiles.Single(c => c.SSN == sSSN);
   mProfileRecord.Password = sNewPassword;
   dc.SubmitChanges();

Are these safe? Does LINQ parameterize the SQL it generates automatically?

解决方案

Yes, LINQ will help stop SQL injection.

LINQ to SQL passes all data to the database via SQL parameters. So, although the SQL query is composed dynamically, the values are substitued server side through parameters safeguarding against the most common cause of SQL injection attacks.

Also, see Eliminate SQL Injection Attacks Painlessly with LINQ for some info.

这篇关于使用 LINQ to SQL 是否有助于防止 SQL 注入的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！