Click here to Skip to main content
15,887,326 members
Home / Discussions / ASP.NET
   

ASP.NET

 
GeneralRe: New to ASP.NET need help Pin
Hari-CodeBlogger16-Apr-14 6:12
Hari-CodeBlogger16-Apr-14 6:12 
GeneralRe: New to ASP.NET need help Pin
Suraj Sahoo | Coding Passion16-Apr-14 7:08
professionalSuraj Sahoo | Coding Passion16-Apr-14 7:08 
GeneralRe: New to ASP.NET need help Pin
Hari-CodeBlogger16-Apr-14 19:17
Hari-CodeBlogger16-Apr-14 19:17 
GeneralRe: New to ASP.NET need help Pin
Suraj Sahoo | Coding Passion16-Apr-14 19:53
professionalSuraj Sahoo | Coding Passion16-Apr-14 19:53 
GeneralRe: New to ASP.NET need help Pin
Hari-CodeBlogger16-Apr-14 22:54
Hari-CodeBlogger16-Apr-14 22:54 
GeneralRe: New to ASP.NET need help Pin
Chris Quinn16-Apr-14 23:02
Chris Quinn16-Apr-14 23:02 
GeneralRe: New to ASP.NET need help Pin
Hari-CodeBlogger16-Apr-14 23:56
Hari-CodeBlogger16-Apr-14 23:56 
SuggestionRe: New to ASP.NET need help Pin
Richard Deeming17-Apr-14 2:18
mveRichard Deeming17-Apr-14 2:18 
Your code is susceptible to SQL Injection[^].

For example, if the user types Robert';DROP TABLE [Table];-- in the username textbox, your query becomes:
SQL
select count(*) from Table where username = 'Robert';DROP TABLE [Table];--'

That's actually two queries; one to select the number of records with the username "Robert", and one to delete the entire table. The "--" at the end comments out the rest of the query.


It's quite easy to fix:
C#
// SqlConnection implements IDisposable, so wrap it in a "using" block:
using (SqlConnection cn = new SqlConnection(ConfigurationManager.ConnectionStrings["userConnectionString"].ConnectionString))
{
    cn.Open();
    
    // Use a parameterized query to avoid SQL injection:
    string sel = "select count(*) from [Table] where username = @username";
    
    // SqlCommand also implements IDisposable:
    using (SqlCommand com = new SqlCommand(sel, cn))
    {
        // Add the parameter to the command:
        com.Parameters.AddWithValue("@username", username.Text);
        
        int temp = Convert.ToInt32(com.ExecuteScalar());
        if (temp == 1)
        {
            Response.Write("User already exists..!!");
        }
    }
}




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


GeneralRe: New to ASP.NET need help Pin
Hari-CodeBlogger17-Apr-14 20:04
Hari-CodeBlogger17-Apr-14 20:04 
QuestionRegarding Tabs Pin
Mahesh Devikar15-Apr-14 18:15
Mahesh Devikar15-Apr-14 18:15 
QuestionOpenXML add cell Pin
byka15-Apr-14 7:46
byka15-Apr-14 7:46 
Questionwhen we need cookiless session and why? Pin
Telstra15-Apr-14 4:29
professionalTelstra15-Apr-14 4:29 
AnswerRe: when we need cookiless session and why? Pin
ZurdoDev15-Apr-14 5:02
professionalZurdoDev15-Apr-14 5:02 
GeneralRe: when we need cookiless session and why? Pin
Telstra15-Apr-14 18:21
professionalTelstra15-Apr-14 18:21 
GeneralRe: when we need cookiless session and why? Pin
ZurdoDev16-Apr-14 2:01
professionalZurdoDev16-Apr-14 2:01 
QuestionAttributes without values Pin
Marc Clifton15-Apr-14 2:39
mvaMarc Clifton15-Apr-14 2:39 
AnswerRe: Attributes without values Pin
David Mujica15-Apr-14 3:07
David Mujica15-Apr-14 3:07 
AnswerRe: Attributes without values Pin
Richard Deeming15-Apr-14 3:51
mveRichard Deeming15-Apr-14 3:51 
GeneralRe: Attributes without values Pin
Marc Clifton15-Apr-14 4:27
mvaMarc Clifton15-Apr-14 4:27 
Questionhow to create quick answers forum same like in code project? Pin
Joshi Akash15-Apr-14 2:13
Joshi Akash15-Apr-14 2:13 
SuggestionRe: how to create quick answers forum same like in code project? Pin
Richard Deeming15-Apr-14 2:22
mveRichard Deeming15-Apr-14 2:22 
QuestionShow file directly on a DIV Pin
Maxpaine6914-Apr-14 4:16
Maxpaine6914-Apr-14 4:16 
AnswerRe: Show file directly on a DIV Pin
Nico Haegens14-Apr-14 22:51
professionalNico Haegens14-Apr-14 22:51 
QuestionHow Can i print byte array asp.net *web application* Pin
Anto Reegan13-Apr-14 19:59
Anto Reegan13-Apr-14 19:59 
QuestionC# Pin
Member 1074507612-Apr-14 18:39
Member 1074507612-Apr-14 18:39 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.