Need a Solution For Stop SQL INJECTION

Question

My Database was attacked by Sql Injetion.It makes lot of problem. please Tell me how to stop Sql Injection attacks. Thanks!..

Rodrigo Bereta · Answer

There is a great book on this subject, and you can read the first chapters on google: Title: SQL Injection Attacks and Defense, Second Edition Link: http://books.google.com.br/books?id=KKqiht2IsrcC&printsec=frontcover&hl=pt-BR&source=gbs_ge_summary_r&cad=0#v=onepage&q&f=false Regards

Sreejesh SP · Answer

Dear bala, We have to block sql query,that is first of sql injection prevention that code is private bool validatextbox() { int f = 1; String str = txtsearchitem.Text; string[] words = str.Split(';'); foreach (string word in words) { string sql = word; var p = new TSql100Parser(true); IList errors; p.ParseStatementList(new StringReader(sql), out errors); if (errors.Count == 0) { f = 0; break; } } if (f == 0) { return false; } else { return true; } } the abode code use namespace are using Microsoft.Data.Schema.ScriptDom; using Microsoft.Data.Schema.ScriptDom.Sql; so please add refernce these two namespaces then check your text box entry for the above code that is private void btnsearch_Click(object sender, EventArgs e) { bool result = validatextbox(); if (result == true) { } } the result is true you enter sql query then blocked else continue the operation so please try this code Thanks Sreejesh

Rodrigo Bereta · Answer

Hi Bala, A common way to stop SQL Injections is you use parameters with your SQL statements or stored procedures. Here is a simple example using Entity Framework with parameter for SQL. using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Data; using System.Data.EntityClient; using System.Configuration; using System.Data.SqlClient; namespace ConsoleApplication2 { class Program { public static void Main() { //string connectionString = ConfigurationManager.ConnectionStrings["AdventureWorks"].ConnectionString; using (EntityConnection entityConnection = new EntityConnection("name=AdventureWorksEntities")) { entityConnection.Open(); string stringCommand = "SELECT VALUE f FROM AdventureWorksEntities.Contact as f WHERE f.FirstName like @pFirstName"; EntityCommand entityCommand = new EntityCommand(stringCommand, entityConnection); EntityParameter param = new EntityParameter(); param.ParameterName = "pFirstName"; param.Value = "James"; entityCommand.Parameters.Add(param); EntityDataReader entityDataReader = entityCommand.ExecuteReader(CommandBehavior.SequentialAccess); while (entityDataReader.Read()) { Console.WriteLine(String.Format("First Name: {0} Last Name: {1}", entityDataReader.GetString(3), entityDataReader.GetString(5))); Console.WriteLine(); } entityDataReader.Close(); } Console.ReadKey(); } } }