How to escape Sqldatasource.Filterexpression?

Asked

Viewed 27 times

1

I have a function that adds a filter to the SqlDataSource. That expression contains a LIKE at the consultation. However, if the person places a character such as ', an error (which evidences SQL Injection).

string cliente = TB_Cliente.Text;

string retorno = "CodOrdemServico = CodOrdemServico ";

if (cliente.Length > 0)
{
   retorno += String.Format("AND Cliente LIKE '%{0}%'", cliente);
}

DS_Grid.FilterExpression = retorno;

How can I escape the LIKE above?

c# webforms

  • your DS_Grid is a Sqldatasource?

  • 3

    Bobby Tables sends his regards

  • Yes, @Pablotondolodevargas

  • 2

    @Maniero I get depressed seeing so many questions with SQL Injection, the worst they still teach in college using string concatenation.

  • @Maniero this system was not made by me. I am giving maintenance :... I am ashamed to use this Web Forms :|

  • See this: https://msdn.microsoft.com/en-us/library/xt50s8kz.aspx

Show 1 more comment

1 answer

3


Use parameters in query.

DS_Grid.FilterExpression = "CodOrdemServico = CodOrdemServico AND Cliente LIKE '%{0}%'";
DS_Grid.FilterParameter.Add(new ControlParameter("Cliente", "TB_Cliente", "Text"));

Browser other questions tagged c# webforms

You are not signed in. Login or sign up in order to post.