Reflection IT Blog

I have updated my DAL article which I wrote late 2002. This article was one of my first aricles and needed an update. The download project now also contains a .NET 2.0 project. It uses the new TraceSource class for tracing purposes. I hope you like it.

Did you know that any malicious user can corrupt your database by injecting harmful SQL strings? To prevent SQL injection, you can use the parameters collections when building SQL strings. However, I developed a more sophisticated method to construct SQL statements from user's input and execute them safely. In this article I describe how to write and execute SQL statements by using objects instead of SQL strings. These objects also address specific SQL statement syntax issues on different RDBMS: they enable you to write generic and RDBMS independent code.