BP14: Use parametrized sql queries
Using parametrized sql queries will help you to prevent sql injection attacks. Do not ever compose the sql command (T-SQL) using string concatenation of string interpolation.
Safe approach
SqlCommand command = ...;
command.CommandText = "SELECT * FROM Customes WHERE CustomerId = @CustomerId";
command.Parameters.Add("@CustomerId", SqlDbType.Int).Value = customerId; command.ExecuteNonQuery();
Security hole 1
SqlCommand command = ...;
command.CommandText = "SELECT * FROM Customes WHERE CustomerId = {customerId}";
command.ExecuteNonQuery();
You are may be thinking that the customerId is int, so what's the problem? It's just a matter of time until someone decides to change the data-type of he customerId value o string and then you have a problem.
Security hole 2
SqlCommand command = ...;
command.CommandText = "SELECT * FROM Customes WHERE CustomerId = " + customerId.ToString();
command.ExecuteNonQuery();
Same as at the previous security hole, it's just a matter of time until someone changes the customerId to some other type during refactoring and then you have a hidden problem just waiting to be exploited.
Download Better Coder application to your phone and get unlimited access to the collection of enterprise best practices.
Chat
Oh, the operator is not available. Leave us your comments. We will answer all your questions as soon as possible.
e
@@xeDO0
1'"
e'||DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(98)||CHR(98),15)||'
L7oVYP7m')) OR 312=(SELECT 312 FROM PG_SLEEP(15))--
A1v25QPv') OR 393=(SELECT 393 FROM PG_SLEEP(15))--
kxT46vOm' OR 479=(SELECT 479 FROM PG_SLEEP(15))--
VTgcz37T'; waitfor delay '0:0:15' --
1 waitfor delay '0:0:15' --
(select(0)from(select(sleep(15)))v)/*'+(select(0)from(select(sleep(15)))v)+'"+(select(0)from(select(sleep(15)))v)+"*/
0"XOR(if(now()=sysdate(),sleep(15),0))XOR"Z
0'XOR(if(now()=sysdate(),sleep(15),0))XOR'Z
if(now()=sysdate(),sleep(15),0)
-1" OR 3+906-906-1=0+0+0+1 --
-1" OR 2+906-906-1=0+0+0+1 --
-1' OR 3+316-316-1=0+0+0+1 or '8BoDIAd6'='
-1' OR 2+316-316-1=0+0+0+1 or '8BoDIAd6'='
-1' OR 3+137-137-1=0+0+0+1 --
-1' OR 2+137-137-1=0+0+0+1 --
-1 OR 3+877-877-1=0+0+0+1
-1 OR 2+877-877-1=0+0+0+1
-1 OR 3+418-418-1=0+0+0+1 --
-1 OR 2+418-418-1=0+0+0+1 --
e
e