topic Parameterized/safe queries for QueryTask? in ArcGIS API for Silverlight Questions https://community.esri.com/t5/arcgis-api-for-silverlight-questions/parameterized-safe-queries-for-querytask/m-p/675297#M17388 <HTML><HEAD></HEAD><BODY><SPAN>Is there any way to build 'safe' queries with a QueryTask?&nbsp; The documentation for the WhereClause property says </SPAN><BR /><BR /><SPAN>"A where clause for the query. Any legal SQL where clause operating on the fields in the layer is allowed, for example: where=POP2000 &gt; 350000"</SPAN><BR /><BR /><SPAN>But sending a where clause as a string built from user input that gets blindly executed seems ripe for a SQL injection attack.&nbsp; Sure I can sanitize the input but that's a lot of work and could possibly prevent legit queries from being accepted on text fields.</SPAN></BODY></HTML> Tue, 26 Oct 2010 14:51:19 GMT PaulAbbott 2010-10-26T14:51:19Z Parameterized/safe queries for QueryTask? https://community.esri.com/t5/arcgis-api-for-silverlight-questions/parameterized-safe-queries-for-querytask/m-p/675297#M17388 <HTML><HEAD></HEAD><BODY><SPAN>Is there any way to build 'safe' queries with a QueryTask?&nbsp; The documentation for the WhereClause property says </SPAN><BR /><BR /><SPAN>"A where clause for the query. Any legal SQL where clause operating on the fields in the layer is allowed, for example: where=POP2000 &gt; 350000"</SPAN><BR /><BR /><SPAN>But sending a where clause as a string built from user input that gets blindly executed seems ripe for a SQL injection attack.&nbsp; Sure I can sanitize the input but that's a lot of work and could possibly prevent legit queries from being accepted on text fields.</SPAN></BODY></HTML> Tue, 26 Oct 2010 14:51:19 GMT https://community.esri.com/t5/arcgis-api-for-silverlight-questions/parameterized-safe-queries-for-querytask/m-p/675297#M17388 PaulAbbott 2010-10-26T14:51:19Z