Search code examples
asp.netsqlsecuritysql-injection

Does asp.net protect against sql injection attacks

By default does ASP.net protect against SQL injection attacks when using ASP controls?

Solution

  • No. As long as you're supplying the SQL, it's up to you to be smart in how you use the controls.

    That usually means sanitizing input and using Parameterized Queries or Stored Procedures over dynamic SQL strings.

    If the control is generating the queries for you (like the Membership Controls, etc.) then you're well protected.