Eliminate SQL Injection Attacks Painlessly With LINQ

Overview

As developers assume more of the security burden, the first web application vulnerability that many developers learn about is a particularly dangerous form of command injection known as SQL injection. Because it's so well-known, SQL injection attacks are common, dangerous, and pervasive. Fortunately, developers can prevent SQL injection easily once they understand the problem. Even better, a new Microsoft data access technology offers .NET developers the opportunity to eliminate SQL injection vulnerabilities altogether - when used properly. That technology is called Language INtegrated Query (LINQ), and it will ship in the upcoming release of Visual Studio "Orcas" and .NET Framework 3.5. This paper explores LINQ's potential for hardening the web application's data access code so that it's impossible to attack through SQL Injection.