In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the user. I am attempting to load a sql injection with the following paramaters.
"INSERT INTO Uploads VALUES ('Name'); DROP TABLE Upload --"
This execution is being commmitted in ASP.net EF 6. My question is, when using this type of injection, it simply throws an error about incorrect syntax. Can someone tell me if this injection is formatted incorrectly to penetrate, or if this is an actual security measure of SQL server 2012?
Update: the actual error I am receiving is
cmd.ExecuteNonQuery(); incorrect Syntax near ('Name')