Why is SQL Server injection not working in ASP.NET MVC 5?

Question

Login password injection is not working - how to implement in my project?

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
    SqlConnection con = new SqlConnection(@"Data Source=DESKTOP-G9SO8KA;Initial Catalog=coolege;Integrated Security=True");
    string qry="select * from tblstudent where Email='"+Login1.UserName+"'and Password='"+Login1.Password+"' ";
    adpt = new SqlDataAdapter(qry,con);
    dt = new DataTable();
    adpt.Fill(dt);

    if (dt.Rows.Count >= 1)
    {
        Response.Redirect("index.aspx");
    }
}

This is a badly worded question. Please provide some more information. How is it not working? What are you trying, What error messages are you getting — level_zebra
– level_zebra, Commented Feb 28, 2020 at 11:05
Please say this isn't production code, it's massively vulnerable to SQL injection, please use the SqlCommand with parameters. Else this obligatory XKCD will happen to you — MindSwipe
– MindSwipe, Commented Feb 28, 2020 at 11:05
What do you mean by password injection ? Do you mean dependency injection ? Side note, use parameters in your query, otherwise, your code is open to SQL Injection ! — Kaj
– Kaj, Commented Feb 28, 2020 at 11:05
This is not ASP.NET MVC 5, it's WebForms. Also: sql injection == troubles, use parameters. — Claudio Valerio
– Claudio Valerio, Commented Feb 28, 2020 at 11:13

apomene · Accepted Answer · 2020-02-28 11:09:05Z

1

Two things:

Don't use concatenate strings on your sql query. Use SQL parameters
You are not opening the connection

Try like:

SqlConnection con = new SqlConnection(@"Data Source=DESKTOP-G9SO8KA;Initial Catalog=coolege;Integrated Security=True");
string qry="select * from tblstudent where Email='@name and Password=@pass";
adpt = new SqlDataAdapter(qry,con);
adpt.SelectCommand.Parameters.Add("@name", SqlDbType.NVarChar).Value = Login1.UserName;
adpt.SelectCommand.Parameters.Add("@pass", SqlDbType.NVarChar).Value = Login1.Password;
con.Open();
...

answered Feb 28, 2020 at 11:09

apomene

14.4k10 gold badges51 silver badges76 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Why is SQL Server injection not working in ASP.NET MVC 5?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related