sql injection

Posts: 4 · Posted: Fri Jan 28, 2005 3:55 am

One thing I've noticed is nobody seems to pay attention to SQL injection. This is a serious problem that occurs when you use forms and don't run sanity checks on the users input. This could leave your customer database in the wrong hands! A simple test you could run would be to try inputting the character ' in to your form that's processed by asp. You can do this in a login field, or in a variable that's actually in the url like http://www.domain.com/test.asp?id=12'. If you receive an error message back from the sql server, you are most likely vulnerable. Take a look at this link http://www.sitepoint.com/article/sql-injection-attacks-safe.

Posts: 1029 · Posted: Fri Jan 28, 2005 4:22 am

Yes... and in ASP.NET theres a very easy way to get around that... Use Parameterized Queries/Updates.

Code:

dim strSQL as string = "SELECT Field1, Field2 FROM Table1 WHERE FieldID=@FieldID"
dim C as New SQLCommand(strSQL, Conn)
With C.Parameters
.Add(New SQLParameter("@FieldID", Request.QueryString("FieldID")))
End With
dim DR as SQLDataReader
Conn.Open()
Try
DR = C.ExecuteReader()
If DR.Read Then
'Do Stuff
End If
DR.Close
Catch Exc as Exception
'Error Handling
End Try
Conn.Close()

or...

Code:

dim strSQL as string = "UPDATE Table1 SET Field1=@Field1, Field2=@Field2 WHERE FieldID=@FieldID"
dim C as New SQLCommand(strSQL, Conn)
With C.Parameters
.Add(New SQLParameter("@Field1", txtField1.Text))
.Add(New SQLParameter("@Field2", txtField2.Text))
.Add(New SQLParameter("@Field1", Request.QueryString("FieldID")))
End With
Conn.Open()
Try
C.ExecuteNonQuery()
Catch Exc as Exception
'Error Handling
End Try
Conn.Close()

or...

Code:

dim strSQL as string = "INSERT INTO Table1 (Field1, Field2) VALUES (@Field1, @Field2)"
dim C as New SQLCommand(strSQL, Conn)
With C.Parameters
.Add(New SQLParameter("@Field1", txtField1.Text))
.Add(New SQLParameter("@Field2", txtField2.Text))
End With
Conn.Open()
Try
C.ExecuteNonQuery()
Catch Exc as Exception
'Error Handling
End Try
Conn.Close()

and the same for DELETE even.

This works because SQL automatically delimits the fields as necessary, regardless of the input supplied. That right there stops the skript kiddies cold.