0

I have a site that allows users to search the database for several items. However I am not that good with SQL and I have read that allowing user to type in boxes that then use "SELECT-statements" is not safe. Code below:

Search-button sends search as parameter:

protected void search_click (object sender, EventArgs e)
        {
            Response.Redirect("Search.aspx?Result=" + TextBoxSearch.Text);
        }

onLoad in my search-page it gets the value and calls getData():

search = Request.QueryString["Result"].ToString();
getData();

getData() method:

protected void getData()
        {
            using (SqlConnection con = new SqlConnection(strCon))
            {
                using (SqlCommand cmd = con.CreateCommand())
                {
                    cmd.CommandText = "SELECT [categoryId], [category] FROM [Category] WHERE ([category]=@search)";
                    cmd.Parameters.AddWithValue("@search", search);

                    con.Open();

                    using (SqlDataReader reader = cmd.ExecuteReader())
                    {
                        if (reader.Read())
                        {
                            LabelCat.Text = reader.GetString(reader.GetOrdinal("category"));
                            HiddenFieldID.Value = reader.GetInt32(reader.GetOrdinal("categoryId")).ToString();
                        }
                        else
                        {

                            LabelCat.Text = "Add"; //When search is made but no cateogry found
                        }
                    }
                }
                con.Close();
            }
        }

Is this safe? I feel like it is very weak against sql-injections but then again I don't know much about that. If it's not safe, please suggest a safe way I can do this.

I am building my application in VS12 using ASP.NET and C# webforms. Building my database using SQL management studio.

EDIT: Eventually I will have to search several tables here using join-statements, don't know if that is relevant but thot I should mention it.

1

You have used parametrized query, which is the bare minimum expectation to prevent on SQL-Injection.

I would suggest some points you can take care of as a validation in C# code

I don't see any server side validation on the text you are getting from TextBoxSearch.Text, you can check for some set of character that can be an attempt for SQL Injection.

you can have a look at the set of input for SQL Injection and make sure that those characters are not there in input string before executing sql query.

Other suggestion is that if you are looking to have multiple joins etc in sql query a better choice is to convert it to Stored procedure.

  • Thank you, that link is helpful. And I will look into stored procedures. – Green_qaue Feb 19 '15 at 7:23
  • 1
    I've been reading a bunch about this and everywhere I look they say that using parameters is enough to protect from SQL-injections. And that stored procedures is also a good idea. Is this true or should I still validate the input on serverside before running the query? – Green_qaue Feb 19 '15 at 8:02
  • Well validation in C#/Javascript is something an extra layer of filter for unwanted character, and if user is not suppose to enter such character as input then for better security you must validate that before it hits the database. In C# Contains can be used. – vijayp Feb 19 '15 at 8:22
0

May I recommend that you read Sommarskog.se/dyn-search?

It investigates all the possible solutions known to the community until today, and does a SWOT analysis on each option.

Best regards, Henrik Staun Poulsen

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.