If the code below is being called from WITHIN an ASP.NET app, as opposed to being triggered by a form, etc, then is it vulnerable to SQL injection?
sb = new StringBuilder();
sb.Append(" SELECT * FROM ICIDAL WHERE SPNSR_IC = " + strIC);
cmd = conn.CreateCommand();
cmd.CommandType = CommandType.Text;
cmd.CommandText = sb.ToString();
reader = cmd.ExecuteReader();
Thanks,
cj
Go to the complete details ...