Ggtcf

What does "Four-F." mean?

How do hiring committees for research positions view getting "scooped"?

How is the partial sum of a geometric sequence calculated?

What is the term when voters “dishonestly” choose something that they do not want to choose?

Pronounciation of the combination "st" in spanish accents

Is there a term for accumulated dirt on the outside of your hands and feet?

Comment Box for Substitution Method of Integrals

Help rendering a complicated sum/product formula

Maths symbols and unicode-math input inside siunitx commands

Deletion of copy-ctor & copy-assignment - public, private or protected?

Should I be concerned about student access to a test bank?

What does "^L" mean in C?

Is there a creature that is resistant or immune to non-magical damage other than bludgeoning, slashing, and piercing?

Is it insecure to send a password in a `curl` command?

Is there a hypothetical scenario that would make Earth uninhabitable for humans, but not for (the majority of) other animals?

Hausdorff dimension of the boundary of fibres of Lipschitz maps

I seem to dance, I am not a dancer. Who am I?

Practical application of matrices and determinants

Synchronized implementation of a bank account in Java

Why is there so much iron?

In Aliens, how many people were on LV-426 before the Marines arrived​?

Probably overheated black color SMD pads

Does the attack bonus from a Masterwork weapon stack with the attack bonus from Masterwork ammunition?

Have the tides ever turned twice on any open problem?

Will this way of using SQLParameter make my function SQL injection proof?

0

Here are some simple codes that search for the value in TargetColumn where SourceColumn = SourceValue.

Here are these codes:

 string cmdText = "select * from " + TableName + " where " + SourceColumn + " = '" + SourceValue + "'";
 SqlCommand dbCommand = new SqlCommand(cmdText, dbConnection);
 SqlParameter sqlParam = new SqlParameter("@" + SourceColumn, SourceValue);
 dbCommand.Parameters.Add(sqlParam);
 SqlDataReader dbReader = dbCommand.ExecuteReader();
 dbReader.Read();
 string _targetValue = dbReader[TargetColumn].ToString();
 dbReader.Close();
 dbCommand.Dispose();
 return _targetValue;

And my questions are:

1. I passed SourceColumn and SourceValue to SqlCommand using SqlParameter, will this make it SQL injection proof?


2. Do I need to use TargetColumn together with SqlParameter too for SQL safety purpose? (but it is for SqlDataReader)


3. If I use SqlParameter for SqlCommand, do I still need to compose a command text in a string and pass it to SqlCommand before SqlParameter is used?


4. Why do I need to add an "@" for SourceColumn? (I just followed the tutorial and added it) And why SourceValue doesn't need an "@"?

The above codes works well to return the expected value, but I'm so not sure about the above questions.

Thanks very much!

c# sql sql-server sql-injection

share|improve this question

asked Mar 7 at 17:23

solidcomersolidcomer

714

• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  Not even close. You are creating parameters and not using them in your query. You are still just building up an unsafe string and executing it. But why of why are you selecting every column and then only returning one? This has all kinds of red flags everywhere but if you are determined to use a single method to read any table (highly unadvised) you should only select the column you need.
  
  – Sean Lange
  Mar 7 at 17:26
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  There is always a risk of SQL Injection when using string concatenation. If the user can input anything that is sent as SQL, there's a risk. Personally, I run checks on values and choose which table/stored procedure to run from there (meaning my users never have access to send SQL Injection attempts).
  
  – Symon
  Mar 7 at 17:26
  
  

  
  
  
  

add a comment | 

0

Here are some simple codes that search for the value in TargetColumn where SourceColumn = SourceValue.

Here are these codes:

 string cmdText = "select * from " + TableName + " where " + SourceColumn + " = '" + SourceValue + "'";
 SqlCommand dbCommand = new SqlCommand(cmdText, dbConnection);
 SqlParameter sqlParam = new SqlParameter("@" + SourceColumn, SourceValue);
 dbCommand.Parameters.Add(sqlParam);
 SqlDataReader dbReader = dbCommand.ExecuteReader();
 dbReader.Read();
 string _targetValue = dbReader[TargetColumn].ToString();
 dbReader.Close();
 dbCommand.Dispose();
 return _targetValue;

And my questions are:

1. I passed SourceColumn and SourceValue to SqlCommand using SqlParameter, will this make it SQL injection proof?


2. Do I need to use TargetColumn together with SqlParameter too for SQL safety purpose? (but it is for SqlDataReader)


3. If I use SqlParameter for SqlCommand, do I still need to compose a command text in a string and pass it to SqlCommand before SqlParameter is used?


4. Why do I need to add an "@" for SourceColumn? (I just followed the tutorial and added it) And why SourceValue doesn't need an "@"?

The above codes works well to return the expected value, but I'm so not sure about the above questions.

Thanks very much!

c# sql sql-server sql-injection

share|improve this question

asked Mar 7 at 17:23

solidcomersolidcomer

714

• 
  
  
  

  
  5
  

  
  
  
  
  
  

  
  
  Not even close. You are creating parameters and not using them in your query. You are still just building up an unsafe string and executing it. But why of why are you selecting every column and then only returning one? This has all kinds of red flags everywhere but if you are determined to use a single method to read any table (highly unadvised) you should only select the column you need.
  
  – Sean Lange
  Mar 7 at 17:26
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  There is always a risk of SQL Injection when using string concatenation. If the user can input anything that is sent as SQL, there's a risk. Personally, I run checks on values and choose which table/stored procedure to run from there (meaning my users never have access to send SQL Injection attempts).
  
  – Symon
  Mar 7 at 17:26
  
  

  
  
  
  

add a comment | 

Here are some simple codes that search for the value in TargetColumn where SourceColumn = SourceValue.

Here are these codes:

 string cmdText = "select * from " + TableName + " where " + SourceColumn + " = '" + SourceValue + "'";
 SqlCommand dbCommand = new SqlCommand(cmdText, dbConnection);
 SqlParameter sqlParam = new SqlParameter("@" + SourceColumn, SourceValue);
 dbCommand.Parameters.Add(sqlParam);
 SqlDataReader dbReader = dbCommand.ExecuteReader();
 dbReader.Read();
 string _targetValue = dbReader[TargetColumn].ToString();
 dbReader.Close();
 dbCommand.Dispose();
 return _targetValue;

And my questions are:

1. I passed SourceColumn and SourceValue to SqlCommand using SqlParameter, will this make it SQL injection proof?


2. Do I need to use TargetColumn together with SqlParameter too for SQL safety purpose? (but it is for SqlDataReader)


3. If I use SqlParameter for SqlCommand, do I still need to compose a command text in a string and pass it to SqlCommand before SqlParameter is used?


4. Why do I need to add an "@" for SourceColumn? (I just followed the tutorial and added it) And why SourceValue doesn't need an "@"?

The above codes works well to return the expected value, but I'm so not sure about the above questions.

Thanks very much!

c# sql sql-server sql-injection

share|improve this question

asked Mar 7 at 17:23

solidcomersolidcomer

714

 string cmdText = "select * from " + TableName + " where " + SourceColumn + " = '" + SourceValue + "'";
 SqlCommand dbCommand = new SqlCommand(cmdText, dbConnection);
 SqlParameter sqlParam = new SqlParameter("@" + SourceColumn, SourceValue);
 dbCommand.Parameters.Add(sqlParam);
 SqlDataReader dbReader = dbCommand.ExecuteReader();
 dbReader.Read();
 string _targetValue = dbReader[TargetColumn].ToString();
 dbReader.Close();
 dbCommand.Dispose();
 return _targetValue;

c# sql sql-server sql-injection

c# sql sql-server sql-injection

share|improve this question

asked Mar 7 at 17:23

solidcomersolidcomer

714

share|improve this question

asked Mar 7 at 17:23

solidcomersolidcomer

714

asked Mar 7 at 17:23

solidcomersolidcomer

714

asked Mar 7 at 17:23

solidcomersolidcomer

714