KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
In our DB access layer we have some dynamic query creation. For instance, we have the following method for building a part of an ORDER BY clause: protected string BuildSortString(string sortColumn, string sortDirection, string defaultColumn) { if (String.IsNullOrEmpty(sortColumn)) { return defaultColumn; } return String.Format("{0} {1}", sortColumn, sortDirection); } The problem is, sortColumn and sortDirection both come from outside as strings, so of course something should be done to prevent possible injection attacks. Does anybody have any idea how this can be done?
Tags (comma-separated)
Save Edits
Cancel