Uri.EscapeDataString Clarification Needed - sql

Question

I'm trying to sanitize data fields in order to prevent sql injections using ASP.NET and along the way have discovered Uri.EscapeDataString, which I believe is the solution(not sure). Here's my code, this is the execution page and Request[cur] is grabbing from an array "dictArr" which holds the names of my fields on the previous page.
foreach(string cur in dictArr) {
if(Request[cur] != "") {
dictionary[cur] = Request[cur].Trim();
}
index++;
}
To my understanding Uri.EscapeDataString makes the data nothing more than a string and is secure, no need to worry about a database wipe out. My question is, how do I use it? Am I doing it correctly below or is there another step I must take? Thanks
foreach(string cur in dictArr) {
if(Request[cur] != "") {
dictionary[cur] = Uri.EscapeDataString(Request[cur].Trim());
}
index++;
}

Answer 1

That's a bit different, you need to prevent attacks from the server point of view. If I was hacking I don't need to use your web site interface, I can POST whatever I like to your server.
That's a bigger concept but good to get across with the web.
There are a bazillion articles on the web about all that, e.g. http://en.wikipedia.org/wiki/SQL_injection
Start digging :)

Answer 2

Uri.EscapeDataString simply converts strings for safe transmission in a URL. Very much like Server.URLEncode, but with some differences.
I'm trying to sanitize data fields in order to prevent sql injections using ASP.NET and along the way have discovered Uri.EscapeDataString, which I believe is the solution(not sure)
No, this is not the correct way. Although encoding everything with EscapeDataString would encode inline SQL queries in a way that will avoid SQL injection, you will end up with URL encoded data in your database.
e.g. My name is O'Leary would be encoded as My name is O%27Leary
This would mean your application (and every other application now or in the future) will have to decode the data on every read. This is not standard and will add extra complexity to operations in future. For example, reading manipulating and writing data back to the database would have to be decoded, manipulated and then reencoded at the correct points.
The correct way to protect against SQL injection is to use parameterised queries.
String query =
"SELECT account_balance FROM user_data WHERE user_name = ?";
try {
OleDbCommand command = new OleDbCommand(query, connection);
command.Parameters.Add(new OleDbParameter("customerName", CustomerName Name.Text));
OleDbDataReader reader = command.ExecuteReader();
// …
} catch (OleDbException se) {
// error handling
}
This automatically protects against SQL injection as the parameters are treated as strongly typed values rather than part of the query structure.