Geek Answers Handbook

Does asp.net protect against SQL injection

By default, does ASP.Net protect against SQL injection attacks when using ASP controls?

+7
source share
7 answers

Not. While you supply SQL, you need to be smart about how you use controls.

This usually means disinfecting the input and using parameterized queries or stored procedures on dynamic SQL strings.

If the control generates requests for you (for example, membership controls, etc.), then you are well protected.

+9
source

Yes and no.

ADO.NET has very good support for parameterization, and when you use it correctly, the parameter values ​​will be automatically sanitized to prevent SQL injection. Thus, you can add parameters to the SqlCommand control (or SqlDataSource ) without worrying about what is in them.

The good news is that parameterizing your material is very simple. I will show you an example of C # for programming it programmatically, but you can do it declaratively using server management tools if you want.

The bad news is that, like everything else, you still need to think about what you are doing. Any string from an unsafe source must be parameterized if you want to have any security. If you paste it verbatim into the query, you will bypass ADO.NET security features.

Secure:

 string name = txtName.Text; sqlCommand.CommandText = "select * from product where name = @name"; sqlCommand.Parameters.AddWithValue("name", name);

Unprotected:

 string name = txtName.Text; sqlCommand.CommandText = "select * from product where name = " + name;

If anything in your SQL query comes directly from the user, you need to put it in the parameter or all bids are disabled. And, like everything else, you can shoot in the foot if you really want to. For example, you can take the SQL code, put it in a parameter and pass it to SQL EXEC . But you would not do that, would you, because it is a very bad idea.

Still not safe (yes, I saw this in production code)!

 string sql = "select * from product where name = " + txtName.Text; sqlCommand.CommandText = "exec(@sql)"; sqlCommand.Parameters.AddWithValue("sql", sql);

TL; DR: ADO.NET has great features for stopping SQL injection, but only if you use them correctly.

+10
source

Most ASP.Net controls (except DataGrid) do not use SQL at all.

If you have your own SQL code in your code (using SqlCommand s), you do not get any free protection; you need to use options.

Several controls that use SQL (SqlDataSource and membership frameworks) use options and are safe for injection.

+8
source

ASP.NET does not protect against SQL injection!

ASP.NET is just a platform for web applications, and it does not dictate how you access your database. It depends on how you implement data access:

  • If you use ADO.NET and build your SQL queries in the form of strings, then you need to sanitize any user input in order to be safe from injection.
  • If you use ADO.NET and use SqlParameters, then I think that you are safe from injection.
  • If you use the ORM tool to access data, I would say that you are safe (at least when using shared)
  • If you use DataSets, then you are likely to be safe too.
  • If you use some third-party data controls, then I hope they take care of SQL injection protection.

I may have forgotten to mention a lot in my answer, but you can see that the answer is “it depends”

+3
source

If you always use SqlParameter s and never combine user input in SQL, you should be safe. You can use SqlParameter without stored procedures too.

+1
source

No, ASP.Net does not protect against SQL injection. MS submitted code for ASP.NEt controls should be SQL Injection free, but this does not interfere with all the problems that one developer can go into. The best defense is a good understanding of SQL Injection and thorough coding. When this is unattainable, for some reason there are tools that can help, such as the Microsoft.NET Code Analysis Tool (CAT.NET) . This is a free VS plug-in that can analyze generated assemblies and detect risks of SQL Injection, XSS and XPath implementation. Such a tool is not bulletproof, but much better than nothing.

+1
source

Partially. There is a filter that is enabled by default, which complicates the construction of an SQL injection attack if it is not disabled.

The method that many ASPNET applications use to access MSSQL databases also makes them generally resistant to SQL injection attacks.

But still it is POSSIBLE to create a vulnerable application if you are careless.

0
source

More articles:


All Articles