Changing to a Parameterized Oracle query

TRX Published at Dev

trx

I am having the below code for connecting to a Oracle database and returning JSON result. But the below code seems to have issues like sql injection, how can I change them being the current code to the parameterized. Do I just being OracleCommand

 public class SampleController : ApiController
  {
     public string Getdetails( int id) 
     {
       using (var dbConn = new OracleConnection("DATA SOURCE=h;PASSWORD=C;PERSIST SECURITY INFO=True;USER ID=T"))
       {

            var inconditions = id.Distinct().ToArray();
            var srtcon = string.Join(",",inconditions);
            dbConn.Open();
            var strQuery = @"SELECT PRIO_CATEGORY_ID AS PRIO, LANG_ID AS LANG, REC_DATE AS REC, REC_USER AS RECUSER, DESCR, COL_DESCR AS COL, ROW_DESCR AS DROW, ABBR FROM STCD_PRIO_CATEGORY_DESCR WHERE REC_USER  IN ("+srtcon+")";
            var queryResult = dbConn.Query<SamModel>(strQuery);
            return JsonConvert.SerializeObject(queryResult); 
    }
 }

Guilherme Holtz

You should try this idea, setting parameters in a command:

using System.Data; using System.Data.SqlClient;

using (SqlConnection connection = new SqlConnection(connectionString))
{
    DataSet userDataset = new DataSet();
    SqlDataAdapter myDataAdapter = new SqlDataAdapter(
        "SELECT au_lname, au_fname FROM Authors WHERE au_id = @au_id", 
        connection);                
    myCommand.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11);
    myCommand.SelectCommand.Parameters["@au_id"].Value = SSN.Text;
    myDataAdapter.Fill(userDataset);
}

Collected from the Internet

Please contact [email protected] to delete if infringement.