title: Is Injection Possible through Dynamic LINQ?
body: <p>Using the Dynamic LINQ library (<a href="http://weblogs.asp.net/scottgu/archive/2008/01/07/dynamic-linq-part-1-using-the-linq-dynamic-query-library.aspx">link</a>), is it vulnerable to injection? and (if so) how can this be protected against?</p>
  
  <p>Some background from <a href="http://msdn.microsoft.com/en-us/library/cc716760.aspx">Security Considerations (Entity Framework)</a>:</p>
  
  <blockquote>
    <p>LINQ to Entities injection attacks:</p>
    
    <p>Although query composition is possible in LINQ to Entities, it is
    performed through the object model API. Unlike Entity SQL queries,
    LINQ to Entities queries are not composed by using string manipulation
    or concatenation, and they are not susceptible to traditional SQL
    injection attacks.</p>
  </blockquote>
  
  <p>Since Dynamic SQL is composed using strings does that mean that it might be susceptible to injection vectors? Or will LINQ to SQL automatically take care of parametrizing your values based on the underlying datatype within the Dynamic LINQ library?</p>
  
  <p>Or is it entirely safe since the dynamic query will be performed in memory rather than against the SQL (thereby negating any benefits from SQL indexes)?</p>
  
  <p>I have been working through understanding the <code>DynamicLibrary.cs</code> code but I'm sure I could be easily overlooking something.</p>
  
  <p>As this question is about the Dynamic LINQ Library itself, this question can be considered to apply to both <code>linq-to-sql</code> and <code>linq-to-entities</code> (despite above reference to Entity Framework).</p>