title: Prevent Sql Injection On Web API 2 inputs
body: <p>Hi we have old API project which is build on ASP.NET (fxows.asmx ) soap service and now we are converting into WEB API 2.so in first phase we are not changing Business logic layer which have thousands of inline queries. my question is this how can we prevent SQL injection in this case ? because SQL parameter is not an option for us because too much change same goes for ORM integration like entity framework so my only guess is if we validate a string property for each input then may be we can prevent it. is there any other way ? also is there any easy way to validate each string property ?</p>
  
  <p>i cannot copy exact code here because we are not allowed to do this so i am posting a dummy sample</p>
  
  <p>we are executing query like this</p>
  
  <pre><code>SqlCommand command = new SqlCommand();
  command.CommandText = "SELECT * FROM Entity where id =" +InputParameter;
  command.CommandType = CommandType.Text;
  SqlDataReader rdr = command .ExecuteReader();
  </code></pre>