While focusing injection related issue, I happen to look into the function QuoteName method in SQL Server. It's used to Enclose or Quote a string with the specified character string. Consider the below query, am asking SQL Server to enclose the string with [ ] (Bracket)
SELECT QUOTENAME('abc [ ] def','[]')
The output is,
[abc [ ]] def]
This function is really useful to enclose the string with the specified literal and avoid SQL Injection issues while passing the parameter.
Quoting the Input String with the Specified Character
1 Comment
Join the conversation! Your thoughts help the community grow.
Sign in to leave a comment
It is the same account you read, post and publish with — and you will come straight back to this page.
Lajapathy ArunPosted May 7, 2012, 11:36 PM
Thanks friend, How it avoid SQL injection?