How to safely create queries in ADO.NET where tables are selected from the changes?

Question

In ADO.NET, you can add parameters to the command object to reliably add user input to the SQL query. What is equivalent to other predicates common to a SQL query?

I am writing a program that is essentially a very limited OR mapper and SQL generator (it is heavily focused on a database with meta-information and other databases that match this metadata). As a result, I should be able to name things like:

string sql = "select " + USER_SELECTED_COLUMNS + 
            " from " + USER_SELECTED_TABLE + 
            " where " + USER_CRITERIA;

Some of them (for example, criteria) are literally entered into my program by trusted users (other developers in my company), while other data are entered into my program by unreliable users (clients) through their searches, etc.

I want to make this program safe, and I know that it is not. Currently, I have replaced USER_SELECTED_COLUMNSthe command options, but I could not find the equivalent for CRITERIA and TABLE. (Or ordinal columns). Are there any ADO.NET features similar to SqlParameterthat I can use for predicates without selection?

Answer 1

, , SQL Injection 1 , , , :

WHITELISTS, BLACKLISTS.

, USER_SELECTED_TABLE, . Equaly, USER_SELECTED_COLUMNS USER_SELECTED_TABLE.

Answer 2

, , . , UserID, UserName. object_id column_id (, form sys.tables.object_id sys.columns.object_id + column_id). SQL, , :

sys.tables(Transact-SQL)
sys.columns(Transact-SQL)

, , .

Answer 3

Microsoft Web Protection Library. SQL-, XSS. , , .