Entity Framework vs SQL Injection (security?)

Question

Hello! I’m new to development so excuse me if the question is silly. If it’s thanks link’s with references so I can better inform myself.

As much as I understand the concept and the use of SQL Injection I can not have enough malice to imagine attacks and practical uses, then I am worried about the security of my application. I am developing in . NET ASP MVC with C# and data access with Entity Framework. I read that the best method to avoid the infamous SQL Injection is to use store procedures for everything. But to do this with Entity Framework, it seems to me, would eventually remove all the practicality of this tool.

Then comes my doubt. If I make such an entity:

public class Cliente
{
    public int ClienteID { get; set; }
    public string Nome { get; set; }
    public string CNPJ { get; set; }
    public string Telefone { get; set; }
}

And create a standard Controller, using Scaffolding where I have an Edit action:

[HttpPost]
[ValidateAntiForgeryToken]
public ActionResult Edit([Bind(Include="ID,Nome,Cnpj,Telefone")] Cliente cliente)
{
    if (ModelState.IsValid)
    {
        db.Entry(cliente).State = EntityState.Modified;
        db.SaveChanges();
        return RedirectToAction("Index");
    }
    return View(cliente);
}

I am subject to SQL Injection if my user enters an Insert or Delete clause in the Name field of my View? If so, how to prevent this?

I see a lot of tutorials and courses teaching like this, but no one comments on security issues.

Answer 1

When we use LINQ to Entities it is free from SQL Injection yes. I’m not sure when using ADO.NET.

Anyway. The way you are doing it is not possible to inject SQL codes.