3 ms·
We're talking about .NET here and plain ADO.NET that comes with .NET will safely handle query parameters in raw SQL if used properly (DbCommand.AddParameter() e
by DrJokepu 11y ago
We're talking about .NET here and plain ADO.NET that comes with .NET will safely handle query parameters in raw SQL if used properly (DbCommand.AddParameter() etc). I suspect that the developer in question was simply concatenating the parameters with the command text string. He probably just never bothered to learn to use the runtime properly.
- moron4hire 11y agoThat is the case. He creates a SqlCommand object and then concats the parameters he wants into the query string, rather than adding a parameter to the query, or creating an SP.