How safe is SharePoint with Code injection (HTML,Javsscript, SQL) because for example the Announcements list allows to enter embed Code in the TextBox. Can this be a threat or SharePoint is already protected against Code injection ?. Does anyone have a sample which we can test for Code injection ?. It is very important for our Client. Thank you.


When using the object model you won't have to worry about SQL Injection as SharePoint handles that for you (it uses parameterized stored procedures internally).

If you enter HTML or JavaScript code into a textbox, SharePoint will store the code as text, you don't worry about the security issue.

And you can go to Web.config to set SafeAgainstScript stops XSS attacks via form fields.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.