3

I'm developing an ASP.NET MVC 3 app and need a way around SQL injections, something simple would be useful. I have followed Microsoft's article on the matter but it doesn't seem to match up with my code and structure.

Any help is greatly appreciated

Improve this question
4
  • simple...always use SQL parameters whenever you build a statement with user input. Commented Apr 28, 2011 at 15:25
  • not that simple though - one could misuse this and use parameters which then in turn get put into dynamic sql on the server side in a proc. Commented Apr 28, 2011 at 15:27
  • @Adam Tuliper then they didn't use SQL parameters everywhere (including stored procedures). Commented Apr 28, 2011 at 16:19
  • true true, I just want to clarify just having them going into say a proc - doesn't fully protect you if you misuse them inside of the proc Commented Apr 28, 2011 at 16:32

1 Answer 1

Reset to default
5

To prevent sql injection:

Do not form any dynamic sql.

  1. Use stored procedures (and do not include any dynamic sql in a stored proc - if you do make sure you use sp_executesql and not exec, as sp_executesql can take a parameterized query
  2. use parameterized queries
  3. use an ORM (ex. entity framework) which uses parameterized queries behind the scenes anyways.

try not to use any dynamic sql - if you must for some reason then make sure you use parameterized queries.

Don't just simply use dynamic sql and remove quotes from them - its a bit dangerous to assume that would be the only attack vector as some do.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.