Click here to Skip to main content
15,898,538 members
Home / Discussions / ASP.NET
   

ASP.NET

 
GeneralRe: How to send an email ? Pin
Parwej Ahamad27-Jun-08 8:41
professionalParwej Ahamad27-Jun-08 8:41 
Questiondatabase Pin
jds120727-Jun-08 6:09
jds120727-Jun-08 6:09 
AnswerRe: database Pin
NetBot27-Jun-08 6:13
NetBot27-Jun-08 6:13 
GeneralRe: database Pin
jds120727-Jun-08 6:39
jds120727-Jun-08 6:39 
AnswerRe: database Pin
Kschuler27-Jun-08 7:25
Kschuler27-Jun-08 7:25 
AnswerRe: database Pin
Mark Churchill27-Jun-08 16:53
Mark Churchill27-Jun-08 16:53 
QuestionDifficulty Implementing Edit Row with Repeater Pin
Scott MacMaster27-Jun-08 4:49
Scott MacMaster27-Jun-08 4:49 
QuestionSQL Injection advise Pin
dabs27-Jun-08 4:43
dabs27-Jun-08 4:43 
Hi all,

My site got hit with SQL injection attack, and I'm now looking for ways to ensure that this won't happen again.

Actually I thought I was pretty well covered against SQL injection attacks, but apparently I was wrong. One technique I've been using is when I pass ID's through querystring is to do something like this:

String strID = Request.QueryString["ID"];
if ( !String.IsNullOrEmpty( strID ) )
{
   int nID = Convert.ToInt32( strID );
   myDBWrapper.GetSomeData( nID );
}

// where GetSomedata would be implemented like this:

public MyDataCollection GetSomeData( int nID )
{
String strSQL = String.Format( "SELECT * FROM MyData WHERE ID = {0}", nID );
// etc... fetching data using SQL Reader etc....
}


Would you consider this code to be vulnerable? I'm aware of SQL parameters, and I use them in other circumstances, such as when inserting into tables. But I've always believed that it wasn't necessary in these situations, because the conversion to Int32 would fail if the Query String parameter did contain some malicious SQL statments.

Any comments?

Regards,
Daníel



Wenn ist das Nunstück git und Slotermeyer? Ja! Beierhund das oder die Flipperwaldt gersput!


AnswerRe: SQL Injection advise Pin
eyeseetee27-Jun-08 4:52
eyeseetee27-Jun-08 4:52 
GeneralRe: SQL Injection advise Pin
dabs27-Jun-08 5:11
dabs27-Jun-08 5:11 
GeneralRe: SQL Injection advise Pin
NeverHeardOfMe27-Jun-08 5:38
NeverHeardOfMe27-Jun-08 5:38 
GeneralRe: SQL Injection advise Pin
dabs27-Jun-08 6:03
dabs27-Jun-08 6:03 
GeneralRe: SQL Injection advise Pin
NeverHeardOfMe27-Jun-08 6:18
NeverHeardOfMe27-Jun-08 6:18 
QuestionImage Not Refreshing Pin
Member 343561427-Jun-08 4:38
Member 343561427-Jun-08 4:38 
AnswerRe: Image Not Refreshing Pin
eyeseetee27-Jun-08 4:49
eyeseetee27-Jun-08 4:49 
AnswerRe: Image Not Refreshing Pin
Guffa27-Jun-08 6:41
Guffa27-Jun-08 6:41 
QuestionSqlDataAdapter Pin
trilokharry27-Jun-08 4:32
trilokharry27-Jun-08 4:32 
AnswerRe: SqlDataAdapter Pin
Parwej Ahamad27-Jun-08 6:23
professionalParwej Ahamad27-Jun-08 6:23 
Questionarraylist to dataset conversion problem Pin
arun.dinky27-Jun-08 4:01
arun.dinky27-Jun-08 4:01 
AnswerRe: arraylist to dataset conversion problem Pin
arun.dinky29-Jun-08 18:23
arun.dinky29-Jun-08 18:23 
QuestionHow Can i read inbox mail from my application Pin
Chetan Patel27-Jun-08 3:39
Chetan Patel27-Jun-08 3:39 
AnswerRe: How Can i read inbox mail from my application Pin
eyeseetee27-Jun-08 3:52
eyeseetee27-Jun-08 3:52 
GeneralRe: How Can i read inbox mail from my application Pin
Chetan Patel27-Jun-08 4:13
Chetan Patel27-Jun-08 4:13 
GeneralRe: How Can i read inbox mail from my application Pin
eyeseetee27-Jun-08 4:21
eyeseetee27-Jun-08 4:21 
GeneralRe: How Can i read inbox mail from my application Pin
leckey27-Jun-08 16:16
leckey27-Jun-08 16:16 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.