Entity Framework, LinqToSQL and SQL Injection

Question

Is it possible for a project that uses full LinqToSQL or Entity Framewok to suffer from SQL Injection.

I think that probably not because the SQL generated by ORM should be without sql injections. But I'm not sure.

Answer 1

When you use these frameworks as intended, i.e. entities / tables directly, then no. All string mappings (i.e. where name = 'smith' ) are parameterized.

The only vulnerabilities are:

• any line can be executed directly against the context. dbContext.ExecuteQuery(); with any destructive string.

• stored procedure that executes dynamic SQL using any given parameters

Answer 2

"It depends".

Regular LINQ queries for L2S or EF objects are safe for injection, but you can always call a stored procedure or function that is not safe for injection.

This will obviously be a marginal case, but yes, it happens that people write SP / functions that are open for injection (compiling SQL-in-lines with parameter values ​​inside proc).