SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

IBM Appscan has detected that some pages in our system are vulnerable to SQL Injection.

The report shows which URLs are vulnerable, so I checked the pages based on the URLs, but most of the pages reported used CAML query to retrieve/add new/update data from list, so no straight SQL query to Database.

I do some research about SQL Injection in CAML query, and found this Link

The question is, is CAML query vulnerable to SQL Injection? If no, is there any proof documentation or something? If yes, then how do we prevent it?

Thank you.

share|improve this question
Not really related, just curious, are you really using <Batch> to add new/update list data? – eirikb Feb 17 '14 at 6:49
Hi eirikb, to delete item from list I'm using <Batch>, but for add new/update item I'm using SPList AddItem() and SPListItem Update() – kamal Feb 19 '14 at 1:36
Ok, I probably just misunderstood, since that is the only way I know how to add new/update using CAML. – eirikb Feb 19 '14 at 12:01
up vote 9 down vote accepted

CAML queries are NOT vulnerable to SQL injection.

I don't think you'll find any direct reference or proof. Consider that the conversion from CAML to SQL all happens between the data layer and the SharePoint API. You can't control how SharePoint generates the SQL for a given CAML statement and therefore you don't have to worry about SQL injection. That's handled by SharePoint.

share|improve this answer
Nice! Thank you very much. – kamal Feb 17 '14 at 2:45
It would be nice to have an authoritative statement from MS on this.… isn't quite it, but at least comes from an MS site... – Alan M Feb 18 '14 at 22:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.