asp.net - Control SQL injection in MVC

Question

It's my first time developing using MVC and I want to make it secure.

When I use HtmlEncode it converts the String to the equivalent HTML String.

The user can enter in the search for example ali' or ali-- and they exist in my database. How to control my search and login from SQL injection please?

Also any tutorial or best practice to prevent script injection?

Answer 1

LINQ and Entity Framework already check for SQL Injection for you.

But you should read the documentation anyhow:

LINQ MSDN Link (section SQL-Injection Attacks)

Entity Framework MSDN Link (section Security Considerations for Queries)

Hope it helps!