How to prevent SQL injection in dynamic sql for .Net Web API?

Question

I just can't find the answers that I like.

I would like to do something like:

public class TestSqlInjectionController : ApiController
{
    public IEnumerable<TestSqlInjectionUser> Get([ValidateSqlInjection]string usernameFilter = null)
    {

wherein [ValidateSqlInjection]seeks bases such as ejection errors, if the input filter comprises ;, --, DROPor DELETE.

So, I will have a convenient list.

Then create a custom attribute:

[FilterField1ValidateSqlInjection]

Here it is possible to split the comma separated list into an array.

Then scroll through the array and make sure that each element matches one of the values ​​in the enumeration.

Does it sound like he is going in the right direction?

The problem is that we have to use dynamic SQL for a lot of search, sorting and filtering. There is no such thing.

, .

, , , .NET Injection?

Answer 1

- SQL, , , - SQL .

, , , SQL. regex , .

- .

Answer 2

, , , Linq, EF -, . , ORDER BY, WHERE SELECT.

​​: https://github.com/NArnott/System.Linq.Dynamic

: http://dynamiclinq.azurewebsites.net/GettingStarted#subValues

Answer 3

. Google.

https://msdn.microsoft.com/en-us/library/ff648339.aspx SQL- MVC http://devproconnections.com/net-framework/protecting-legacy-web-applications-antixss

SQL-, SQL. . SQL . , , linq .

https://msdn.microsoft.com/en-us/library/bb882637.aspx