c# - SQL Injection attack prevention: where do I start

Question

I'm looking to make my site secure against SQL injection attacks. Does anyone have any good links to make the site secure against these types of attacks in an ASP.NET site (c#, web forms)?

EDIT:

I should point out at I am using the Entity Framework

Answer 1

The first and best line of defense is to not use dynamic SQL.

Always use parameterized queries.

Take a look at the OWASP page about SQL Injection.