Secure SQL Queries

Question

0.00/5 (No votes)

See more:

Hi,
In my project I am using SQL queries like this
But you already informed me that these queries not secure at all, then what is the secure sql query.
How can give the right to user to enter the statename

Pls send me any example for secure queries for inserting data by the user

try
{

String str2 = "select code from state where code='" + this.txtstatecode.Text + "'";
SqlCommand cmd1 = new SqlCommand();
cmd1.CommandText = str2;
cmd1.Connection = conn;
//cmd.ExecuteNonQuery();
SqlDataReader rd = cmd1.ExecuteReader();
//stem.Windows.MessageBox.Show(rd.Read().ToString ());
if (rd.Read())
{
System.Windows.MessageBox.Show("Record already existing");

}
else
{
String str = "insert into State(Code,Name)values ('" + this.txtstatecode.Text + "','" + this.txtstatename.Text + "')";
//if rdr.GetString ()

cmd1.CommandText = str;
cmd1.Connection = conn;
cmd1.ExecuteNonQuery();

//System.Windows.MessageBox.Show("Data Inserted Successfully");
//cmd.Connection = conn;

DataTable dt = new DataTable();
String str1 = "select code,name from State";// where code='" + this.txtstatecode.Text + "'";
cmd1.Connection = conn;
cmd1.CommandType = CommandType.Text;
cmd1.CommandText = str1;
SqlDataAdapter adp = new SqlDataAdapter(cmd1);
SqlCommandBuilder cb = new SqlCommandBuilder(adp);
/* paste here */
adp.Fill(dt);
bs.DataSource = dt;
statedg5.ItemsSource = bs;
adp.Update(dt);
this.statedg5.Items.Refresh();
// rd.Close();
}

}
catch (Exception e1)
{
System.Windows.MessageBox.Show(e1.Message);
}

Posted 19-Jan-10 1:56am

LukmanulHakeem.T

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

thatraja · Answer 1 · 2010-01-19T02:02:00

you should use SqlCommand object for executing sql query. Pass the values as parameters to the SqlCommand object. try search engines for help. And have a look at following.

Reasons I'd fire anyone who wrote this code for me

1 - hard coded connection string
2 - SQL code in presentation layer
3 - lack of any sort of database security, esp in what looks like an account creation page, which anyone could presumably access and thus erase or hack the entire DB
4 - the password for the database is abc
5 - using an integer for a boolean flag
6 - this method does several things, which should be refactored into different methods
7 - using Response.Write to communicate with the user instead of setting text in a properly styled and positioned control
by Christian Graus

AspDotNetDev · Answer 2 · 2010-01-19T02:05:00

When you combine strings to pass parameters to a query like this:

C#

String str2 = "select code from state where code='" + this.txtstatecode.Text + "'";

You open yourself up to SQL injection attacks. Instead, pass parameters to the command like this:

C#

String str2 = "select code from state where code=@StateCode";
SqlCommand cmd1 = new SqlCommand();
cmd1.Parameters.Add(new SqlParameter("StateCode", this.txtstatecode.Text));

Escaping and such will be handled by the .Net Framework. That way, you will not open yourself up to SQL injection attacks.

Secure SQL Queries

2 solutions

Solution 1

Solution 2

Add your solution here

Preview 0