SQL Command Injection

Is there a way to Inject SQL command in LINQ Connection? When he's not using the typical

string sqlstr="SELECT * FROM TABLE WHERE COLUMN = '" + PARAMETER + "' ";
List tbl = context.ExecuteQuery(sqlstr).ToList();

-we all know that by using this way, you can easily inject a sql command. But how about in this:

var sqlstr = (from tbl in context.Table
                where column == parameter
                select new{tbl.column}).ToList();

QUESTION: What would be the input in parameter in order for you to inject a sql command?

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sign in to answer this question

It is the same account you read, post and publish with — and you will come straight back to this page.

Sign inCreate an account

• Y

  Yin14y agoPosted Nov 15, 2012, 5:56 AM

  Yes, I need to ensure the security. Hmmm
• 

  Suthish Nair14y agoPosted Nov 15, 2012, 5:53 AM

   waw.. you playing with your application security..
  
   Read this:
  
   http://www.hpenterprisesecurity.com/vulncat/en/vulncat/dotnet/sql_injection_linq.html