title: Sharepoint Database Security - SQL injection
body: <p>I've developed a custom web part for SharePoint, and I'm concerned about its security.  The web part is essentially a quiz framework that begins by having a user 'register'; they simply enter their name and email address.  For successful quizzes, the result is recorded in a list, and those registration variables are placed directly into the list.</p>
  
  <p>Should I be concerned about SQL injection attacks?  Is the data escaped by SharePoint before it's added to the list?  Or, does SharePoint use named parameters with a prepared statement?  Alternatively, does it just go in verbatim?</p>
  
  <p>Thanks for any insight.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I should maybe rephrase that I am inserting code into a SharePoint list, so it's not going 'directly' into the database.  I'm uncertain about the process that takes places (specifically regarding security) when an item is inserted into a list and (I'm assuming) into a database table somewhere.  Here is some of the code I'm using:</p>
  
  <p>Get user input through standard HTML input</p>
  
  <pre><code> output.Write("&lt;div&gt;Please enter your e-mail address&lt;/div&gt;&lt;div&gt;&lt;input type=\"text\" value=\"\" size=\"30\" name=\"takerEmail\"&gt;&lt;/div&gt;");
  </code></pre>
  
  <p>Here is how the data is inserted</p>
  
  <pre><code>            using (SPSite siteSuccessWrite = new SPSite("http://www.mycompany.com"))
              {
                  using (SPWeb webSuccessWrite = siteSuccessWrite.OpenWeb())
                  {
                      SPList insertResults = webSuccessWrite.Lists[resultsList];
                      SPListItem quizEntry = insertResults.Items.Add();
  
                      quizEntry["firstName"] = firstName;
                      quizEntry["lastName"] = lastName;
                      quizEntry["email"] = email;
                      quizEntry["phone"] = phone;
                      quizEntry["department"] = dept;
                      quizEntry["score"] = score;
  
                      quizEntry.Update();
                  }
              }
  </code></pre>