When using built-in .Net functions, such as Membership.GetUser(), ProfileCommon.Create(), and others, it is obvious that they go out and grab/change data in the backend SQL database for you.
My question is, do I have to worry about SQL injection or other attacks when passing data to these functions from a form on the page? For example:
string username = txtusername.Text;
Membership EditorUsername = Membership.GetUser(username);
Should I be Server.HtmlEncoding "username" when passing the form data to Membership.GetUser, or does the .Net framework already protect itself from these security issues when using the built-in functions?
Thanks!
...
Go to the complete details ...