Validate Post Data in ASP.NET MVC

Question

I have this controller method below:

[HttpPost]
public ActionResult Login(UserDetails userdetails)

What did I do so far ?

1. Replaced potential SQL Candidates in my form (via JQuery side , eg. replace '&' by 'amp')
2. I have added ModelState.IsValid() in ServerSide to check.

Are these two checks enough or How should I make sure that userDetails.UserName is free from Injected SQL ? (Like 1=1 SQL Injection attacks)

Answer 1

使用实体框架，Dapper或常规参数化查询应足够。