如何防止Visual Basic 2012中的以下代码上的SQL注入

Question

I"m confused on how to prevent SQL injection, I've looked online. Do I use a store procedure, or do I Create variables, Im just completely lost.

 Try
 connection.Open()
 ’we got here so our connection to the db is sound
 chosen = cboBooks.SelectedIndex
 id = customerList(cboCustomers.SelectedIndex)
 isbn = isbnList(cboBooks.SelectedIndex)
 If number <= qty Then
     Dim sql As String
     sql = "INSERT INTO purchase(customer_id, ISBN, store_id, quantity)
                        VALUES(" & id & ", " & isbn & ", 1, " & number & ");"
     Dim cmd As New SqlCommand(sql, connection)
     Dim rows As Integer
     rows = cmd.ExecuteNonQuery()
     If rows >= 1 Then
     ’now update the inventory to reflect a sale
     sql = "UPDATE inventory SET quantity = (quantity -" & number & ")
            WHERE inventory.ISBN = " & isbn & " AND  store_id = 1"
     ’define and execute the query command
      Dim cmd2 As New SqlCommand(sql, connection)
      rows = cmd2.ExecuteNonQuery

Answer 1

Whenever you are concatinating sql and use variables that the user has direct access to, you are in danger of SQL Injection.

In your case the fix might look something like this:

 sql = "INSERT INTO purchase(customer_id, ISBN, store_id, quantity)
                    VALUES(@id, @isbn , 1, @number);"
Dim cmd As New SqlCommand(sql, connection)
cmd.Parameters.AddWithValue("@id", id )
cmd.Parameters.AddWithValue("@isbn", isbn )
cmd.Parameters.AddWithValue("@number", number)
Dim rows As Integer
rows = cmd.ExecuteNonQuery()

The second query would look like this:

sql = "UPDATE inventory SET quantity = (quantity - @number)
        WHERE inventory.ISBN = @isbn AND store_id = 1"
Dim cmd2 As New SqlCommand(sql, connection)
cmd2.Parameters.AddWithValue("@number", id )
cmd2.Parameters.AddWithValue("@isbn", isbn )
rows = cmd2.ExecuteNonQuery

By using parameters, the string is escaped for any would be malicious code.

Other good references:

What is SQL injection?

How does the SQL injection from the "Bobby Tables" XKCD comic work?

EDIT:

As @AndyLester points out in the comments, what I am trying to suggest is that using user data to concatenate into your executable code is DANGEROUS!

Answer 2

To prevent SQL injections, you can achieve it in two ways.

1. Validating user input: Using the appropriate types prevents SQL injections naturally. For instance, if customer_id, store_id, and quantity are all integers, then they are safe and you don't need to worry about them. As for the ISBN (I think you use string?), if you validate it to make sure it only contains digits and hyphens, then it is also safe.

2. Using parameterized queries: This is a great way to prevent SQL injections and also reduce possible bugs in queries.

A good code uses both technics.

You didn't specify the language/platform you're using, but it looks like VB.Net. Here is how you add parameters to your query:

sql = "INSERT INTO purchase(customer_id, ISBN, store_id, quantity)
       VALUES(@id, @isbn , 1, @quantity);"
Dim cmd As New SqlCommand(sql, connection)
cmd.Parameters.AddWithValue("@id", id)
cmd.Parameters.AddWithValue("@isbn", isbn)
cmd.Parameters.AddWithValue("@quantity", number)