Simple user input sanitization

Question

I am using Server.HttpEncode(), and HttpDecode() in order to sanitize user form input, as well as having the server throw an exception when a "potentially dangerous" input is detected.

(Data is then saved to an MSSQL database)

Is this considered enough to stop SQL / Javascript injection and similar?

Answer 1

No it doesn't prevent it at all. It is used more so to prevent XSS attacks as explained by Microsoft here. Read this Stackoverflow question for some ideas on preventing SQL injection.

Depending on the environment you are in, I would use a technology such as the Entity Framework or NHibernate which prevents SQL injection altogether, so you do not even have to worry about it.

Answer 2

Possibly, but almost certainly not.