在SQL查询中用双引号替换单引号

Question

I am creating a vulnerable Windows Forms application using C# to practise SQL Injection and understand why this vulnerability happens in the first place. I am aware that I should be using parameterised queries to develop a secure application.

The application requires a user to enter their username and password in order to login. The following code is responsible for dynamically generating an SQL query based on user's input:

public SqlDataReader performLogin(String username_input, String password_input)
{
    String username = username_input;
    String password = password_input;

    String sqlquery = "SELECT * FROM users where username='" + username + "' and password='" + password + "'";

    SqlCommand query = new SqlCommand(sqlquery, conn);

    SqlDataReader reader = query.ExecuteReader();

    return reader;
}

The SQL Server database contains a username called 'admin', and I can login as that user without knowing their password by entering the following data in the username field:

admin'--

However, I would like to modify the dynamically generated SQL query so that I would have to enter double quotes (not two single quotes) instead of one single quote in order to login as admin:

admin"--

I've tried replacing every double quote character with a single quote and every single quote with double quotes. I've also tried replacing every single quote character with double quotes and escaping them as follows:

String sqlquery = "SELECT * FROM users where username=\"" + username + "\" and password=\"" + password + "\"";

String sqlquery = "SELECT * FROM users where username=@"" + username + "@" and password=@"" + password + "@"";

I've not been able to find a working solution yet. I either get syntax errors or the application crashes after I attempt to login.

Answer 1

Why not just replace the username before passing it onto the query?

string finalUsername = username.Contains("\"") ? username.Replace("\"", "'") : username;
string sqlQuery = "SELECT * FROM users where username='" + finalUsername + "' and password='" + password + "'";

If you wanted, you could even prevent the original vector:

string finalUsername = username.Contains("\"") ? username.Replace("\"", "'") : (username.Contains("'") ? username.Replace("'", "") : username);
string sqlQuery = "SELECT * FROM users where username='" + finalUsername + "' and password='" + password + "'";