1. Feedback
  2. Blazor
  3. 51745

Welcome to the Blazor feedback portal. We’re happy you’re here! If you have feedback on how to improve the Blazor, we’d love to hear it!

  • Check out the features or bugs others have reported and vote on your favorites. Feedback will be prioritized based on popularity.
  • If you have feedback that’s not listed yet, submit your own.

Thanks for joining our community and helping improve Syncfusion products!

2
Votes

Support to generate parameterized filter query in grid to prevent from SQL injection attacks

The problem is that the '%f%' is a static/constant value and not a parameterized one.  That means each time the user presses a key the SQL server must recompile the query/plan as the filter is hard-coded.  If the filter was parameterized, it would only have to compile the query/plan once and change only the parameter that is passed in with it.

Additionally (and probably even more important) using parameterized queries protects against injection attacks:

https://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements

As I am guessing you already have something like this on your end, I am primarily interested in the performance benefits. :)


Please let me know of any questions you have and I will assist you.