在gridview中防止SQL注入

Question

I want to double check to make sure that this is preventing the injections correctly.

I have old code that uses a GridView (written by someone else a long, long time ago) in ASP .NET 3.5.

In the .aspx page (the GridView uses this datasource):

<asp:SqlDataSource ID="sdsUserTables" runat="server" 
    ConnectionString="<%$ ConnectionStrings:Main %>" 
    DeleteCommand="DELETE FROM [MyTable] WHERE [tableID] = @tableID">
    <DeleteParameters>
        <asp:Parameter Name="tableid" Type="Int32" />
    </DeleteParameters>        
</asp:SqlDataSource>

Does this prevent injections on tableId?

The code behind has this:

protected void sdsUserTables_Deleting(object sender, SqlDataSourceCommandEventArgs e)
{
    e.Command.Parameters["@tableId"].Value = myTableId;
}    

Answer 1

yes, you're using a variable and it's type is declared, those two factors will prevent a SQL injection attack.

See... http://www.mikesdotnetting.com/Article/113/Preventing-SQL-Injection-in-ASP.NET

You can do the exact same thing by making your sql code into a stored procedure and passing a variable into that.

Answer 2

This code looks ok to me to prevent a SQL injection attack:

• you are using a <asp:Parameter> tag for your SQL query. By this way, it will not be a part of the SQL command and will be sent to the SQL server as a parameter: this is the right way, regardless its type.

• the SQL command and the Connection String in the <asp:SqlDataSource> tag will be embedded to the assembly: it will not be available to the user nor visible in the page. So it cannot be tampered.

If you want to enforce protection against SQL injection in general:

Ensure that the [validateRequest][1] parameter of your pages is set to "true":

// This parameter is normally set to "true" by default in the machine.config file
<pages validateRequest="true" /> 

• Also there is a good habit that consists in validating all user inputs, and limiting input length to the necessary amount of characters.

For example:

// assuming myTableId is a string

try
{
    int i = int.Parse(myTableId)
    e.Command.Parameters["@tableId"].Value = i;
}
catch
{
    throw new ApplicationException("Table Id should be an integer");
}

If your user inputs are strings, there is no need to check for every SQL keywords if you use parameters.

Answer 3

I think in the case of the example you gave above, you are definitely safe. It's always a best practice to sanitize your inputs.

Assuming that you have a form (of some type) with a textbox on it, that doesn't have a limit to the amount of text that can be typed in it (this could be potentially very bad).

Here is an example:

sqlParameter sqlParam = new SqlParameter();
sqlParam.ParameterName = "@testParam";
sqlCommand.Parameters.AddWithValue("@testParam", textBox1.Text);

In the example above, once again assuming your textbox is unbound, the fact that you are stuffing the potentially malicious string into a parameter prevents the raw data from having an ill-effect on your table(s)/database(s).