Best way to prevent SQL injection using Javascript or C #?

Question

I am currently writing an application that uses ajax on the front panel and ASP.NET (C #) on the back panel.

A small part of the application makes an AJAX call in the internal code (to retrieve records from an SQL database)

How can I prevent SQL injection from JScript?

I know that it is generally unsafe to check with javascript because javascript can be disabled, but since it is an AJAX call, so if the user has disabled JavaScript, AJAX will never work.

What is the best way to test or speed up input?

Like Add_Slashes () in PHP?

thank

Daniel

Answer 1

, SQL.

Answer 2

SQL- , , .

, Javascript, , Javascript .

AJAX: JavaScript; Javascript, , .

, , .

Answer 3

, Parametirized Query Adhoc SQL

Answer 4

, , .

Ajax- , , SQL-.

- , , .

, LINQ to SQL Entities , , SQL Injection.

, sql , .

LINQ, ( !) .

Answer 5

SQL:

http://use-the-index-luke.com/where-clause/bind-parameters

, , .

Answer 6

Javascript , Javascript .

Javascript , , - , . ( , - , , , ' , ), , , .

AJAX 30 , , . . Javascript , ( ).

, , , , . "" SQL-, , , . , . , ; , , "", , , . , (, , , , -, , , , , ).

, Javascript , .

, , , .

. SQL ( , ' , ), , , # Parameters ADO.NET, SQL ( ).

Answer 7

, . /. - . .

, - . (, ..). , . "O'Brian" , , javascript SQL-.

, - . SQL- / SQL. - , . : http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

, / , . script, , json-string, HTML- .. .. . , : http://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet AntiXSS / : http://www.microsoft.com/downloads/en/details.aspx?FamilyID=f4cd231b-7e06-445b-bec7-343e5884e651