I'm designing a website using asp.net (webforms) and C#. I have a table which has 23 columns.
In the code below, reader is a SqlDataReader and command is a SqlCommand object. I'm using the following code to output query result from it:
command.CommandText = "SELECT * FROM devices WHERE device_level='" + ACCESS_LVL + "'" + "ORDER BY device_name";
reader = command.ExecuteReader();
and then I loop through it using
while(reader.Read());
to output the results.
However accessing some columns causes an index out of range exception (indexes above 17). My table has 23 columns but reader.FieldCount returns only 18.
This issue is not happening on my local machine when debugging the code. It only happens when I upload the project to my web server.
Using mylittleadmin database management panel (installed on the remote server) I can see all of the 23 columns.
"WHERE device_level='" + ACCESS_LVL + "'"is wide open to injection and needs to be changed ASAP.SELECT *, instead list the columns that you expect explicitlyabolfa.devicesanddbo.devices)