This is a standard query and i need to change it as parameterized one for saving that from sql injection. can someone give me an answer for this?

Viewed 29
var filteredData = context.getProviderData
                    .FromSqlRaw("exec getProviderData @filter='" + filter + "', @pageSize=" + rows + ", @pageIndex=" + page + ", @allProviders=" + allProviders + ", @Colname='" + sidx + "', @sort='" + sord + "', @Terminatedproviders='" + TerminatedProviders + "', @Prpr_entity='F'")
                    .ToList();
1 Answers

As per the documentation,

var filteredData = context
    .getProviderData
    .FromSqlRaw(@"exec getProviderData
        @filter,
        @pageSize=@rows,
        @pageIndex=@page,
        @allProviders,
        @Colname=@sidx,
        @sort=@sord,
        @Terminatedproviders,
        @Prpr_entity='F'",
        filter,
        rows,
        page,
        allProviders,
        sidx,
        sord,
        Terminatedproviders)
     .ToList();
Related