Need a Solution For Stop SQL INJECTION

Marish Balasubramanian

13y2.1k.NET

My Database was attacked by Sql Injetion.It makes lot of problem.
please Tell me how to stop Sql Injection attacks.
Thanks!..

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Rodrigo Bereta13y ago
There is a great book on this subject, and you can read the first chapters on google:

Title:
SQL Injection Attacks and Defense, Second Edition

Link:
http://books.google.com.br/books?id=KKqiht2IsrcC&printsec=frontcover&hl=pt-BR&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false

Regards
0
Sreejesh SP13y ago
Dear bala,

             We have to block sql query,that is first of sql injection prevention

that code is

private bool validatextbox()
        {
            int f = 1;
            String str = txtsearchitem.Text;
            string[] words = str.Split(';');
            foreach (string word in words)
            {
                string sql = word;
                var p = new TSql100Parser(true);
                IList errors;
                p.ParseStatementList(new StringReader(sql), out errors);
                if (errors.Count == 0)
                {
                    f = 0;
                    break;
                }
            }
            if (f == 0)
            {
                return false;
            }
            else
            {
                return true;
            }

        }

the abode code use namespace are

using Microsoft.Data.Schema.ScriptDom;
using Microsoft.Data.Schema.ScriptDom.Sql;

so please add refernce these two namespaces then check your text box entry for the above code

that is
private void btnsearch_Click(object sender, EventArgs e)
        {
            bool result = validatextbox();
            if (result == true)
            {

             }
      }

the result is true you enter sql query then blocked
else continue the operation

so please try this code

Thanks

Sreejesh
0
Rodrigo Bereta13y ago
Hi Bala,

A common way to stop SQL Injections is you use parameters with your SQL statements or stored procedures.

Here is a simple example using Entity Framework with parameter for SQL.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Data;
using System.Data.EntityClient;
using System.Configuration;
using System.Data.SqlClient;

namespace ConsoleApplication2
{
class Program
{
public static void Main()
{
//string connectionString = ConfigurationManager.ConnectionStrings["AdventureWorks"].ConnectionString;

using (EntityConnection entityConnection = new EntityConnection("name=AdventureWorksEntities"))
{
entityConnection.Open();

string stringCommand = "SELECT VALUE f FROM AdventureWorksEntities.Contact as f WHERE f.FirstName like @pFirstName";

EntityCommand entityCommand = new EntityCommand(stringCommand, entityConnection);

EntityParameter param = new EntityParameter();
param.ParameterName = "pFirstName";
param.Value = "James";
entityCommand.Parameters.Add(param);

EntityDataReader entityDataReader = entityCommand.ExecuteReader(CommandBehavior.SequentialAccess);

while (entityDataReader.Read())
{
Console.WriteLine(String.Format("First Name: {0} Last Name: {1}", entityDataReader.GetString(3), entityDataReader.GetString(5)));
Console.WriteLine();
}

entityDataReader.Close();
}
Console.ReadKey();

}
}
}
0

Need a Solution For Stop SQL INJECTION

SQL Injection Attacks and Defense, Second Edition