Hi,

I've read many articles that suggest all access to a DB should be through stored procedures in order to better secure your data from SQL Injection attacks etc.

I disagree this this and really enjoy the performance gains tools like NHibernate give you.

I would like to know what measures (if any) NHibernate takes to protect against potential harmful input into SQL statements.

Organizations that have security concerns about using ORM tools may be more open to using them knowing that the ORM tool offers some protection.

Thanks

NHibernate allows using parameters in queries - this alone should prevent most, if not all, injection attacks. Using parameters instead of building HQL strings directly out of user-supplied values is in fact the recommended approach.

Thanks. That is what I was hoping for. Is there an article I can review that talks about this and demonstrates it?

I don't know of any articles, it's a relatively simple feature I'd say.

Here's the gist of it:

So...you can use standard HQL to construct your query and pass the parms to it.

Thanks for the pointers.