3 ms·
Manually escaping or sanitizing should be the last resort. Why, other than "because one might forget it"? That is, what if bits of the query depend on various
by PavlovsCat 13y ago
Manually escaping or sanitizing should be the last resort.
Why, other than "because one might forget it"?
That is, what if bits of the query depend on various conditions and need to be constructed part by part? Keeping the placeholders and the actual values synced seems like a nightmare in those cases.. unless I am missing something.
- ygra 13y agoOne could imagine something like public static void AddParameterValue(this SqlCommand cmd, string paramName, object value) { if (cmd.CommandText.Contains("@" + paramName)) cmd.Parameters.AddWithValue(paramName, value); } to help set parameters only if they are referenced in the SQL statement.