title: How to prevent Gremlin injection in C#?
body: <p>When user enters data in a text box, many possibilities of SQL Injection are observed. To prevent this, many methods are available to have placeholders in the SQL query, which are replaced in the next step of code by the input. Similarly, how can we prevent Gremlin Injection in C#?</p>
  
  <p>Example:
  The following is a sample code for adding a node in a graph database. The value of variables: name and nodeId is taken from user via a text box.</p>
  
  <pre><code>StringBuilder sb = new StringBuilder();
  sb.Append("g.addV('" + name + "').property('id','"+nodeId+"')");
  
  /*The following simply executes the gremlin query stored in sb*/
  
  IDocumentQuery&lt;dynamic&gt; query = client.CreateGremlinQuery&lt;dynamic&gt;(graph, sb.ToString());
  while (query.HasMoreResults){
     foreach (dynamic result in await query.ExecuteNextAsync())
      {
         Console.WriteLine($"\t {JsonConvert.SerializeObject(result)}");
      }}
  </code></pre>
  
  <p>A malicious user may write the attributeValue like </p>
  
  <p><em>name:</em> "person" (without quotes)</p>
  
  <p><em>id:</em> "mary');g.V().drop();g.addV('person').property('id', 'thomas" (without quotes)</p>
  
  <p>This will clear all the existing nodes and add only one node with the id: thomas</p>
  
  <p>How do I prevent this from happening? </p>
  
  <p>I don't wish to blacklist characters like ";" or ")" as this is permissible as input for some data.</p>
  
  <p>Note:
  Gremlin is a traversal language used in graph databases: </p>
  
  <p><a href="https://tinkerpop.apache.org/gremlin.html" rel="noreferrer">https://tinkerpop.apache.org/gremlin.html</a></p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/cosmos-db/gremlin-support" rel="noreferrer">https://docs.microsoft.com/en-us/azure/cosmos-db/gremlin-support</a></p>