SQL injection?

[John]

Is it possible for SQL injection to be used through the Edit feature on an
asp.net 2005 data grid view control?

 

[Ken Cox - Microsoft MVP]

Are you using stored procedures? That's usually the safe way.

 

[Darren Kopp]

Check out
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/paght000003.asp.
That's the patterns and practices group and their security for asp.net
section.

HTH,
Darren Kopp
http://blog.secudocs.com/

 

[Dragon]

I use the SqlCommand object and pass the value through parameter.
it will escape the character itself.
enough to avoid injection, maybe.

 

[Ken Cox - Microsoft MVP]

Here's something that just came out that will ensure you don't get hit:

http://www.microsoft.com/downloads/...92-7ad9-496c-9a89-af08de2e5982&displaylang=en

Ken
Microsoft MVP [ASP.NET]