Reputation: 15470
I need to avoid being vulnerable to SQL injection in my ASP.NET application. How might I accomplish this?
Upvotes: 22
Views: 45504
Reputation: 29020
Everyone says "Use parameters". We'd have to say it less if it wasn't so perversely difficult.
Use QueryFirst. The temptation to concatenate is removed, and the right way becomes the easiest way. You create a parameter just by typing @myParam in your SQL, the tool does the rest.
disclaimer: I wrote QueryFirst
Upvotes: 0
Reputation: 6068
SQL injection occurs because the query to the database is being constructed in real time, for example:
SELECT * From Table1 WHERE " + UserInput
UserInput
may be malicious and contain other statements that you do not intend.
To avoid it, you need to avoid concatenating your query together.
You can accomplish this by using parametrized queries - check out the DBCommand
object for your particular DB flavor.
Upvotes: 5
Reputation: 686
Use XSS Secured UrlEncode using Microsoft.Security.Application.AntiXss.UrlEncode and SQL injection will not work. Or You can use ASP.NET – JSON – Serialization and Deserialization
Also test your application with SiteDigger from Macfee Fre Tool.
Few More are from here
.NET Security Toolkit v1.0 .NETMon v1.0 Validator.NET v1.0
Upvotes: 0
Reputation: 12621
As others have said, don't concatenate user input to create dynamic sql statements; always use parameterized SQL when using dynamic SQL. However I will point out that this rule also applies when creating dynamic sql inside of a stored proc. This fact is something people often overlook. They think they are safe because they are "using stored procedures."
Upvotes: 1
Reputation: 2581
Scott Guthrie posted a decent little article about this a while back. In it, he offers 5 suggestions for protecting yourself:
Don't construct dynamic SQL Statements without using a type-safe parameter encoding mechanism. [...]
Always conduct a security review of your application before ever put it in production, and establish a formal security process to review all code anytime you make updates. [...]
Never store sensitive data in clear-text within a database. [...]
Ensure you write automation unit tests that specifically verify your data access layer and application against SQL Injection attacks. [...]
Lock down your database to only grant the web application accessing it the minimal set of permissions that it needs to function. [...]
He does a decent job of explaining why these are important, and links to several other resources as well...
Upvotes: 4
Reputation: 8335
Never trust user input - Validate all textbox entries using validation controls, regular expressions, code, and so on
Never use dynamic SQL - Use parameterized SQL or stored procedures
Never connect to a database using an admin-level account - Use a limited access account to connect to the database
Don't store secrets in plain text - Encrypt or hash passwords and other sensitive data; you should also encrypt connection strings
Exceptions should divulge minimal information - Don't reveal too much information in error messages; use customErrors to display minimal information in the event of unhandled error; set debug to false
Useful link on MSDN Stop SQL Injection
Upvotes: 16
Reputation: 880
Use parametrized queries and/or stored procedures and parse your parameters via SQL parameters. Never generate SQL code by concatenating strings. Also do some reading about SQL injection and about writing secure code, because preventing SQL injection is only a small part of security. There is many more (like XSS - Cross Site Scripting). If a hacker wants to compromise your site/application he will look for more then only SQL injection.
Upvotes: 4
Reputation: 6450
The book, "Building Secure ASP.NET Applications" guideline has a section on this topic.
Upvotes: 0
Reputation: 102548
Understand what exactly SQL Injection is and then never write anything that is vulnerable to it.
Upvotes: -3
Reputation: 82136
NEVER trust user input, always validate it, and use sql parameters. Should be enough basis to prevent SQL injection.
Upvotes: 3
Reputation: 15253
Hopefully, this will help:
http://www.codersbarn.com/post/2008/11/01/ASPNET-Data-Input-Validation.aspx
The short answer is to use parameterized queries.
Anthony :-) www.codersbarn.com
Upvotes: 2
Reputation: 36340
Use parameters! It really is that simple :-)
Create your queries like this (for MS Sql server with C#):
SqlCommand getPersons = new SqlCommand("SELECT * FROM Table WHERE Name = @Name", conn);
Here @Name is the parameter where you want to avoid sql injection and conn is an SqlConnection object. Then to add the parameter value you do the following:
getPersons.Parameters.AddWithValue("@Name", theName);
Here theName is a variable that contains the name you are searching for.
Now it should be impossible to do any sql injections on that query.
Since it is this simple there is no reason not to use parameters.
Upvotes: 18
Reputation: 340456
Use Prepared Statements (link to an ASP.NET tutorial that uses prepared statements in the 'To add nodes for products' section). that's all there is to it.
Well, that or use an ORM, like Linq to SQL or NHibernate, they internally use prepared statements.
Upvotes: 17
Reputation: 338376
Even though your question is very generic, a few rules always apply:
SqlCommand
with SqlParameter
) and put user input into parameters.Upvotes: 30
Reputation: 380
Try to use Stored Procedures, and validate the input on your data. Do not use any direct SQL like INSERT INTO ...
Upvotes: -4