Need information on SQL Injection in ASP.Net MVC 4

Question

enter image description here

I have a report generated by IBM appscanner tool. It scanned my mvc application and on some urls it gave me high alerts.
I'm trying to figure out how to perform parameter manipulation on my page like above information provided in the report to find the issue.
Example of the link on which the above report is based : localhost:46887/Myproject/country/edit/1

Doing SQL string concatenation are we? :) Make sure to parameterized your query to avoid this. — Jimmy Chandra
– Jimmy Chandra, Commented May 14, 2015 at 7:24

ikirachen · Accepted Answer · 2015-05-14 07:27:16Z

1

As a rule of a thumb: Aways cast the values (provided through Request) to concrete type which are you using in the application logic. If you are using ORM/ODM to access the data storage you recieve built in SQL injection protection :). This tool may be examins only the the query string and just assumes that injection is possible.

answered May 14, 2015 at 7:27

ikirachen

777 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

rohit singh Over a year ago

Yes i figured out the same. The query string value was being manipulated and i'm using LINQ and EF so It automatically is protected agains SQL injection.

Collectives™ on Stack Overflow

Need information on SQL Injection in ASP.Net MVC 4

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related