Have Geek Brain

SQL injection help

Please help me prevent my data from SQL injection. I replaced "to" (single quote with 2 quotes) doing any operation on sql server. Please tell me what I need to do to prevent my application from SQL injection. my application is in asp.net 2.0

I'll use parameterized queries, but what about my old projects. I mean where I wrote a string query and sent it to sql server as command text.

Please tell me if anyone can insert SQL injection even if I replaced "with"?

+2


a source to share


3 answers


The best you can do is use parameterized queries if the language / framework supports it.

EDIT: asp.net can handle this. Use SqlCommand



Example from here -

private static void UpdateDemographics(Int32 customerID,
    string demoXml, string connectionString)
{
    // Update the demographics for a store, which is stored 
    // in an xml column. 
    string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
        + "WHERE CustomerID = @ID;";

    using (SqlConnection connection = new SqlConnection(connectionString))
    {
        SqlCommand command = new SqlCommand(commandText, connection);
        command.Parameters.Add("@ID", SqlDbType.Int);
        command.Parameters["@ID"].Value = customerID;

        // Use AddWithValue to assign Demographics.
        // SQL Server will implicitly convert strings into XML.
        command.Parameters.AddWithValue("@demographics", demoXml);

        try
        {
            connection.Open();
            Int32 rowsAffected = command.ExecuteNonQuery();
            Console.WriteLine("RowsAffected: {0}", rowsAffected);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
    }
}
+9


a source


Instead of manually flushing the SQL, you should use a library to access the SQL.

Do not create the query string by hand, and if you need to pass parameters through, use parameterized queries and stored procedures.



See this example in VB.NET.

+1


a source


I'm not sure, but I don't think there is a quick way to protect your old projects from SQL injection attacks.

I think the best thing would be to actually change the data access code in older projects to use parameterized queries.

Or you could do what Oded suggests and overwrite old projects with the library.

+1


a source






More articles:


All Articles