Click here to Skip to main content
15,911,035 members
Home / Discussions / C#
   

C#

 
GeneralRe: file reading and access database Pin
HahnTech3-Nov-04 12:09
HahnTech3-Nov-04 12:09 
Generalinput string not in a correct format Pin
webhay3-Nov-04 9:24
webhay3-Nov-04 9:24 
GeneralRe: input string not in a correct format Pin
Jordi Corominas3-Nov-04 10:54
Jordi Corominas3-Nov-04 10:54 
GeneralRe: input string not in a correct format Pin
Dave Kreskowiak3-Nov-04 11:48
mveDave Kreskowiak3-Nov-04 11:48 
GeneralRe: input string not in a correct format Pin
webhay3-Nov-04 12:01
webhay3-Nov-04 12:01 
GeneralRe: input string not in a correct format Pin
Dave Kreskowiak3-Nov-04 17:08
mveDave Kreskowiak3-Nov-04 17:08 
GeneralRe: input string not in a correct format Pin
Jordi Corominas3-Nov-04 21:35
Jordi Corominas3-Nov-04 21:35 
GeneralRe: input string not in a correct format Pin
Dave Kreskowiak4-Nov-04 0:57
mveDave Kreskowiak4-Nov-04 0:57 
Sure it works, but it's SO vulnerable it's almost funny! Consider the following code:
// Put together the SQL Statement:
//  SELECT COUNT(*) FROM Users WHERE username=? AND userpass=?
//
string mySQLStatement = "select count(*) from users where userName='" + userName.Text + "' and userPass='" + userPassword.Text + "'"

Now, if the attack enters:
Username: ' OR 1=1 --
Password: anything

The SQL Statement becomes:
SELECT COUNT(*) FROM Users WHERE username='' OR 1=1 --' AND userpass='anything'

Well, in SQL syntax, two consecutive dashes in a row (--) is a comment, just like // is C++ or C# is a comment or ' in VB. So you real SQL statement now looks like:
SELECT COUNT(*) FROM Users WHERE username='' OR 1=1

The result form the SQL statement will always be the number of records in the table, never 0.

Search the web for "SQL Injection Attacks" to find out more and see lots of example of how to break cheap code like this.


RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

GeneralRe: input string not in a correct format Pin
Jordi Corominas4-Nov-04 1:16
Jordi Corominas4-Nov-04 1:16 
Generalregistry key editing/creation Pin
Pyro Joe3-Nov-04 9:11
Pyro Joe3-Nov-04 9:11 
GeneralRe: registry key editing/creation Pin
Alex Korchemniy3-Nov-04 9:18
Alex Korchemniy3-Nov-04 9:18 
GeneralRe: registry key editing/creation Pin
Salil Khedkar3-Nov-04 21:59
Salil Khedkar3-Nov-04 21:59 
GeneralRe: ListView KeyDown Event Pin
cnet20083-Nov-04 16:09
cnet20083-Nov-04 16:09 
GeneralSystem.Drawing.Printing.PrinterSettings Pin
Hugo Migneron3-Nov-04 6:31
Hugo Migneron3-Nov-04 6:31 
GeneralRe: System.Drawing.Printing.PrinterSettings Pin
sreejith ss nair3-Nov-04 17:23
sreejith ss nair3-Nov-04 17:23 
GeneralRe: System.Drawing.Printing.PrinterSettings Pin
Hugo Migneron4-Nov-04 3:32
Hugo Migneron4-Nov-04 3:32 
GeneralFlash Form Title Bar Pin
Member 8730573-Nov-04 5:05
Member 8730573-Nov-04 5:05 
QuestionFlash GUI article??? Pin
eshipman3-Nov-04 4:46
eshipman3-Nov-04 4:46 
GeneralIcons in Task bar Pin
sommarafton3-Nov-04 4:29
sommarafton3-Nov-04 4:29 
GeneralRe: Icons in Task bar Pin
Alex Korchemniy3-Nov-04 8:14
Alex Korchemniy3-Nov-04 8:14 
GeneralDetect "Minimize" and "Autostart" Pin
Stefan Troschuetz3-Nov-04 3:25
Stefan Troschuetz3-Nov-04 3:25 
GeneralRe: Detect "Minimize" and "Autostart" Pin
Nick Parker3-Nov-04 4:40
protectorNick Parker3-Nov-04 4:40 
GeneralRe: Detect "Minimize" and "Autostart" Pin
Stefan Troschuetz3-Nov-04 4:49
Stefan Troschuetz3-Nov-04 4:49 
GeneralRe: Detect "Minimize" and "Autostart" Pin
Christian Pedersen3-Nov-04 5:04
Christian Pedersen3-Nov-04 5:04 
GeneralRe: Detect "Minimize" and "Autostart" Pin
Stefan Troschuetz3-Nov-04 22:54
Stefan Troschuetz3-Nov-04 22:54 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.