ASP.NET

string sqlQuery = "UPDATE rights SET category_key = " + toCat + " WHERE rights_key = @rights_key";
QueryContainer Instance = new QueryContainer(sqlQuery);

ExecuteNonQuery(sqlQuery);

<pre>

Also when  I do an SQL ExecuteScaler statement I am using from a C# client I am adding C# variables to the hard coded values in the SQL statement Execute ExecuteScaler client like this:

<pre>

queryString.Append(" SELECT isnull(");
queryString.Append("    (SELECT CASE WHEN convert(smalldatetime, '" + valDateMaterialRequired + "')  < (getdate() + isNull(hier_asp_config.late_days_num, 3)) THEN '1' ELSE '0' END");
queryString.Append("    FROM hier_asp_config ");
queryString.Append("    WHERE asp_key = " + aspKey + " )");
queryString.Append(" , CASE WHEN convert(smalldatetime, '" + valDateMaterialRequired + "')  < (getdate() + 3) THEN '1' ELSE '0' END)");


 return ExecuteScaler(queryString.ToString()).ToString();

<pre>

Now in the Class that calls the actual SQL I am using these techniques:

<pre>

protected int ExecuteNonQuery(string queryString)
        {
            int returnValue = 0;

            if (!_iserror)
            {
                if (_trace)
                    DoTrace("TAMIS.Data.Loader.ExecuteNonQuery", queryString);

                if (_connection == null || _connection.State == ConnectionState.Closed)
                {
                    OpenConnection();
                }

                DbCommand command = _provider.CreateCommand();
                command.Connection = _connection;
                command.CommandText = queryString;
                command.CommandType = CommandType.Text;
                if (_useTransaction) { command.Transaction = _transaction; }

                try
                {
                    returnValue = command.ExecuteNonQuery();
                }
                catch (Exception e)
                {
                    if (e is EntryPointNotFoundException)
                        throw e;
                    //if (_useTransaction == true)
                    //    _transaction.Rollback();
                    RollBack();
                    LogBLL bll = new LogBLL();
                    bll.WriteErrorLog(e);
                    _iserror = true;
                }
                finally
                {

                    if ((!KeepAlive && _connection.State == ConnectionState.Open) || _iserror == true)
                    {
                        CloseConnection();
                    }

                }

            }
            else
            {
                returnValue = -1;
            }

            return returnValue;
        }
<pre>

And this:

<pre>
protected object ExecuteScaler(string queryString)
        {

            object returnValue = null;
            if (!_iserror)
            {
                if (_trace)
                { DoTrace("TAMIS.Data.Loader.ExecuteScalar", queryString); }

                if (_connection == null || _connection.State == ConnectionState.Closed)
                {
                    OpenConnection();
                }

                DbCommand command = _provider.CreateCommand();
                command.Connection = _connection;
                command.CommandText = queryString;
                command.CommandType = CommandType.Text;
                if (_useTransaction) { command.Transaction = _transaction; }

                try
                {
                    returnValue = command.ExecuteScalar();
                }
                catch (Exception ex)
                {
                    if (ex is EntryPointNotFoundException)
                        throw ex;
                    //if (_useTransaction == true)
                    //_transaction.Rollback();
                    RollBack();

                    LogBLL bll = new LogBLL();
                    bll.WriteErrorLog(ex);

                   _iserror = true;
                }
                finally
                {

                    if ((!KeepAlive && _connection.State == ConnectionState.Open) || _iserror == true)
                    {
                        CloseConnection();

                    }

                }
            }
            else
            {
                returnValue = -1;
            }

            return returnValue;
        }
<pre>

These are clearly giving me SQL injection errors. In my case I cant change the code to stored procedures like they should be so How do I make the C# variable values from my client calling code and still work but not give me SQL injection errors?

<html>
  <head>
    .. all the styles and scripts included here...
  </head>
  <body>
    ...the markup of the page goes here...
    <script>
      Sys.Application.add_load(function (sender, args) {
        if (!args.get_isPartialLoad()) {
            window.radopen('/Michlol3/GeneralPages/Agreement.aspx?guid=421b25ef-9815-4588-861a-08ecb17f7e5e', 'idAgreementWindow');
        }
      });
      Sys.Application.initialize();
      ...more in-page script here...
    </script>
  </body>
<html>

public static List<_RetreiveBookDetails_Result> GetBooks(BookAuthorObj ba)
        {
             List<_RetreiveBookDetails_Result>  bookList = new List<_RetreiveBookDetails_Result>();

            using (var baContext = new BookAuthorDBContext())
            {
                bookList = baContext._RetreiveBookDetails(ba.FirstName,ba.LastName,ba.Genre, ba.Title).ToList();              
            }
            return bookList;
        }