Author: arjones85 | Posted on: 12/5/2008 2:13:45 PM | Views : 510

 When using built-in .Net functions, such as Membership.GetUser(), ProfileCommon.Create(), and others, it is obvious that they go out and grab/change data in the backend SQL database for you.
 My question is, do I have to worry about SQL injection or other attacks when passing data to these functions from a form on the page? For example:


string username = txtusername.Text;
Membership EditorUsername = Membership.GetUser(username);
 
Should I be Server.HtmlEncoding "username" when passing the form data to Membership.GetUser, or does the .Net framework already protect itself from these security issues when using the built-in functions?
 
Thanks!

...

Go to the complete details ...