Is this LINQ based search safe against SQL injection / XSS attack?

P开发者_开发技巧lease refer following database search tutorial and advise if search methodology is safe, especially since it is taking input from a textbox.

http://net.tutsplus.com/tutorials/asp-net/enabling-search-functionality-in-your-site-using-the-new-features-in-aspnet-35/

Protected Sub btnSubmit_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles btnSubmit.Click  

    Dim db As New BlogDBDataContext()  

    Dim q = From b In db.Blogs _  
            Where b.BlogContents.Contains(txtSearch.Text.Trim()) Or _  
                  b.BlogTitle.Contains(txtSearch.Text.Trim()) _  
            Select b  

    lv.DataSource = q  
    lv.DataBind()
End Sub  

---

Yes, that's safe. You aren't at risk from SQL injection attacks using LINQ unless you create the SQL yourself, for example if you use ExecuteQuery.

---

You are safe in this case. You have to go out of your way to enable SQL injection using LINQ to SQL. See http://www.thinqlinq.com/Post.aspx/Title/Does-LINQ-to-SQL-eliminate-the-possibility-of-SQL-Injection