I'm working with a third-party API that requires me to give it complete, runnable SQL query text - I cannot use approaches such as parameterization in order to guard against input that may break a SQL statement, or worse, allow for SQL injection.

As a result, I'm looking for a library (preferably for .NET) that will help me to sanitize inputs as I am building up a query (e.g. in its most basic sense, escaping special characters in a string, ensuring table names are legal, etc.).

I know I can using regular find/replace style of replacing unacceptable characters with the corresponding escape code, but as this article describes, it's very possible to overlook a particular edge case. I also didn't want to re-invent the wheel if it already existed.

The closest thing I've found so far to what I'm looking for is Microsoft's Microsoft.SqlServer.Management.SqlParser.Parser namespace, which contains an EscapeSequence class that can help prepare valid query statement tokens. (E.g. it will turn O'Reilly into 'O''Reilly')

However, I was hoping to find something a bit more stand-alone (i.e. doesn't require installation of SQL Server-related components).

Has anyone encountered such a library?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.