c# - Preventing Injection Attacks with Excel Export -

i have posted code below excel exporting class (most of anyway). issue incurring export not safe when comes injection attacks. able mask initial command parameters, however, when passed parameterized command export(string) method, loses values set within parameters; passes literal string (i.e. select * table column_name = @parameter1). trying figure out way prevent code being unsafe. need functionality. has been fine in past because of desired audience of applications, cannot use specific code considering customer facing , more less open public use. :/ suggestions of how can achieve goal?

public static void export(string crossoverstatement = "select * table") {     // @@parameters     //     // crossoverstatement string :     //     string representation of procedure executed obtain desired crossover query results.      //create our database connection excel reference , workbook/worksheet using export data     string odbcconnection = "server info";      application xls = new application();     xls.sheetsinnewworkbook = 1;     // create our new excel application , add our workbooks/worksheets     workbook workbook = xls.workbooks.add();     worksheet crossoverpartsworksheet = xls.worksheets[1];     // hide our excel object if it's visible.     xls.visible = false;     // turn off screen updating our export process more quickly.     xls.screenupdating = false;      crossoverpartsworksheet.name = "crossover";     if (crossoverstatement != string.empty)     {         crossoverpartsworksheet.select();         var xlsheet = crossoverpartsworksheet.listobjects.addex(sourcetype: xllistobjectsourcetype.xlsrcexternal,                                                                 source: odbcconnection,                                                                 destination: xls.range["$a$1"]).querytable;         xlsheet.commandtext = crossoverstatement;         xlsheet.rownumbers = false;         xlsheet.filladjacentformulas = false;         xlsheet.preservecolumninfo = true;         xlsheet.preserveformatting = true;         xlsheet.refreshonfileopen = false;         xlsheet.backgroundquery = false;         xlsheet.savepassword = false;         xlsheet.adjustcolumnwidth = true;         xlsheet.refreshperiod = 0;         xlsheet.refreshstyle = xlcellinsertionmode.xlinsertentirerows;         xlsheet.refresh(false);         xlsheet.listobject.showautofilter = false;         xlsheet.listobject.tablestyle = "tablestylemedium16";         // unlink our table server , convert range.         xlsheet.listobject.unlink();         // freeze our column headers.         xls.application.rows["2:2"].select();         xls.activewindow.freezepanes = true;         xls.activewindow.displaygridlines = false;         // autofit our rows , columns.         xls.application.cells.entirecolumn.autofit();         xls.application.cells.entirerow.autofit();         // select first cell in worksheet.         xls.application.range["$a$2"].select();         // turn off alerts prevent asking 'overwrite existing' , 'save changes' messages.         xls.displayalerts = false;     }      // make our excel application visible     xls.visible = true;      // release our resources.     marshal.releasecomobject(workbook);     marshal.releasecomobject(crossoverpartsworksheet);     marshal.releasecomobject(xls); } 

here best way complete request come with. perform parameterized query , pass resulting data table can use when calling export(datatable).

problem resolved.

public static void export(system.data.datatable crossoverdatatable) {     // @@parameters     //     // crossoverdatatable datatable :     //     data table containing information exported our excel application.     //     requested way circumvent sql injection opposed initial overload accepting string .commandtext.      application xls = new application();     xls.sheetsinnewworkbook = 1;      // create our new excel application , add our workbooks/worksheets     workbook workbook = xls.workbooks.add();     worksheet crossoverpartsworksheet = xls.worksheets[1];      // hide our excel object if it's visible.     xls.visible = false;      // turn off screen updating our export process more quickly.     xls.screenupdating = false;      // turn off calculations if set automatic; can prevent memory leaks.     xls.calculation = xls.calculation == xlcalculation.xlcalculationautomatic ? xlcalculation.xlcalculationmanual : xlcalculation.xlcalculationmanual;      // create excel table , fill our query table.     crossoverpartsworksheet.name = "crossover data";     crossoverpartsworksheet.select();     {          // create row our column headers.         (int column = 0; column < crossoverdatatable.columns.count; column++)         {             crossoverpartsworksheet.cells[1, column + 1] = crossoverdatatable.columns[column].columnname;         }          // export our datatable information excel.         (int row = 0; row < crossoverdatatable.rows.count; row++)         {             (int column = 0; column < crossoverdatatable.columns.count; column++)             {                 crossoverpartsworksheet.cells[row + 2, column + 1] = (crossoverdatatable.rows[row][column].tostring());             }         }     }      // freeze our column headers.     xls.application.rows["2:2"].select();     xls.activewindow.freezepanes = true;     xls.activewindow.displaygridlines = false;      // autofit our rows , columns.     xls.application.cells.entirecolumn.autofit();     xls.application.cells.entirerow.autofit();      // select first cell in worksheet.     xls.application.range["$a$2"].select();      // turn off alerts prevent asking 'overwrite existing' , 'save changes' messages.     xls.displayalerts = false;      // ******************************************************************************************************************     // section commented out can enabled later have excel sheets show on screen after creation.     // ******************************************************************************************************************     // make our excel application visible     xls.visible = true;      // turn screen updating on     xls.screenupdating = true;      // turn automatic calulation on     xls.calculation = xlcalculation.xlcalculationautomatic;      // release our resources.     marshal.releasecomobject(workbook);     marshal.releasecomobject(crossoverpartsworksheet);     marshal.releasecomobject(xls); }