Best way to sanitize user input?

[Brad Baker]

I have an asp.net page written in C# which provides a search box which
updates a gridview control using the following code:

protected void search_button_Click(object sender, EventArgs e)
{
string search_terms = search_textbox.Text;
string search_fields = search_dropdown.Text;

string sql_string = "SELECT * FROM [Table] WHERE " + search_fields + "
LIKE '%" + search_terms + "%'";
Datasource.SelectCommand = sql_string;
}

The code above works perfectly however it appears to be vulnerable to SQL
injection attacks and I am wondering how I can best santize user input prior
to using it in my sql query. Is there a function built into C# I can use for
this?

Thanks!
Brad

[Brad Baker]

Never mind - I think I found what I was looking for here:
http://msdn.microsoft.com/library/de...00003.asp?_r=1

Brad

"Brad Baker" <br**@nospam.nospamwrote in message
news:uR**************@TK2MSFTNGP06.phx.gbl...

>I have an asp.net page written in C# which provides a search box which
updates a gridview control using the following code:

protected void search_button_Click(object sender, EventArgs e)
{
string search_terms = search_textbox.Text;
string search_fields = search_dropdown.Text;

string sql_string = "SELECT * FROM [Table] WHERE " + search_fields + "
LIKE '%" + search_terms + "%'";
Datasource.SelectCommand = sql_string;
}

The code above works perfectly however it appears to be vulnerable to SQL
injection attacks and I am wondering how I can best santize user input
prior to using it in my sql query. Is there a function built into C# I can
use for this?

Thanks!
Brad