Search code examples
tridion

Do I need to SQL escape parameters I pass to the Tridion broker?

I'm passing an SQL "like" query to the Tridion broker database, via the Query API:

var mkc = new CustomMetaKeyCriteria("Text");
var mvc = new CustomMetaValueCriteria(mkc, "%" + query + "%", Criteria.Like);
query.Criteria = mvc;
var results = query.ExecuteQuery();

The query variable is something that has been directly passed in by the user.

Do I need to try and SQL escape that parameter, or will Tridion handle this via parameterisation (or otherwise)?

Solution

  • SDL products normally pass their parameters to the database in a structured way, so without string concatenation. This implies that you should not have to escape the criteria.

    Did you try it? Does it work?