21

Often in the questions when people have a question about NullReferenceExceptions we direct them to the question What is a NullReferenceException, and how do I fix it?

Is there similar type question we can direct people to about not using string concatenation in building up SQL queries and instead to use parameters to pass in their values?

7
  • 22
    Sure, xkcd already provided one. Won't stop them of course. Commented Oct 5, 2014 at 23:05
  • 7
    @HansPassant - The irony is that cartoon has probably made a more positive impact on developers than the actual documentation and all of the angry DB Admins who witness these things. Commented Oct 5, 2014 at 23:19
  • 3
    stackoverflow.com/questions/60174/…
    – Robert Harvey Mod
    Commented Oct 6, 2014 at 1:21
  • 1
    I use this for vb.net questions: How do I create a parameterized SQL query? Why Should I? Commented Oct 6, 2014 at 5:56
  • @Bjørn-RogerKringsjå Can you post that comment as an answer, I would like to upvote that. Commented Oct 6, 2014 at 13:14
  • @RobertHarvey: 113 answers, 28 of those still visible. Are you sure you locked that early enough? Commented Oct 6, 2014 at 15:53
  • I did some searching based on the most popular language tags on SO, but I could not find any good canonical Q/As other than the two listed here (for PHP and VB.NET). So I have started a list answer for everyone to contribute. It does seem that some more canonical Q/As are needed (especially for Java and JavaScript). Commented Oct 6, 2014 at 18:31

2 Answers 2

17

List of canonical Q/As for SQL injection and parameters based on the most popular language tags. If a good canonical Q/A has not been identified, candidates and source material is listed instead.

Note: Feel free to make appropriate updates to this list.


Language Neutral: How can I explain SQL injection without technical jargon?

C#: (Proposed): ASP.NET, C# How to Pass a StringQuery to a custom SQL Command (Links to this discussion and others mentioned in it)

C++: None Identified

Java: None Identified

JavaScript: None Identified

PHP: How can I prevent SQL injection in PHP?

Python: None Identified

VB.NET: How do I create a parameterized SQL query? Why Should I?

3
  • 5
    Why isn't this list included in the SQL et all tags wiki?
    – Braiam
    Commented Oct 6, 2014 at 19:05
  • 1
    Do you think that would be a useful place to list the canonical Q/As? Commented Oct 6, 2014 at 20:33
  • 5
    Yep............. that should be the place.
    – Braiam
    Commented Oct 6, 2014 at 20:36
5

I use the following link for questions tagged with vb.net:

How do I create a parameterized SQL query? Why Should I?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .