Will using LINQ to SQL help prevent SQL injection Will using LINQ to SQL help prevent SQL injection asp.net asp.net

Will using LINQ to SQL help prevent SQL injection


Yes, LINQ will help stop SQL injection.

LINQ to SQL passes all data to the database via SQL parameters. So, although the SQL query is composed dynamically, the values are substitued server side through parameters safeguarding against the most common cause of SQL injection attacks.

Also, see Eliminate SQL Injection Attacks Painlessly with LINQ for some info.


You're good to go. Linq does parameterize the data it sends to the database.

Use the Log property to check out what's happening: dc.Log = Console.Out;


It should because the SQL emitted uses named parameters which cannot be exploited to execute arbitrary SQL.