Q:

how to prevent SQL Injection in a asp.net website

For email entry in a text box by the user i am doing client side check, to find whether the email is valid or not
 string emailexist = "SELECT COUNT(DISTINCT UserID) as count FROM tbl_user WHERE Email=@Email ";     

   <asp:RegularExpressionValidator ID="RegularExpressionValidator2" ValidationGroup="Login" ControlToValidate="txtUserName"
                            ValidationExpression="\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*" CssClass="Error"
                             runat="server" />

is this regular expression good enough to prevent sql injection for email.
Other Text:
   string groupExistQuery = "SELECT COUNT(DISTINCT GroupID) as count FROM tbl_group WHERE GroupName=@GroupName";   

I am doing a query in server side to check whether the group name entered by the user is already available in the database, there is a strong possibility to perform sql injection here. How should I prevent from it.

A:

A regex is unrelated to SQL injection (blacklisting etc is never the strongest approach); however, the use of the parameter @Email means (assuming it remains parameterised) that is not susceptible to SQL injection.
SQL injection relates to inappropriate concatenation of input; the main tool to fight it is parameters, which has already happened here.
For example, if you did:
var sql = "SELECT ...snip... WHERE Email='" + email + "'"; // BAD!!!!!

then that is heavily susceptible to SQL injection. By using a parameter, the value is not treated as part of the query, so the attacker does not have at attack vector.

A:

If you use parameterised values, you are going to be fine regardless, you can not inject via parameters, only via concatenated values.

A:

You can prevent it by not using Direct SQL and using parameterised queries and/or Stored Procedures instead.

