how to prevent from sql injection for text boxes on both sides client / server

Question

I have a problem with text boxes.

When a user writes something in a text box, it will save it but sql query or bad text or some thing automatically injected into the database, I didn't know what is happening to it; it saves false data in the database.
I am thinking that sql was automatically injected by the format of text.

Can anyone provide me with a solution for this?

I can't restrict my text box for special characters, this is why I am facing so many problems.

Possible duplicate of http://stackoverflow.com/questions/305044/how-can-i-avoid-sql-injection-attacks-in-my-asp-net-application — Erwin, Sep 05 '12 at 06:42
want some textbox code for its event or something else like that — Syed Ali, Sep 05 '12 at 07:25

score 3 · Accepted Answer · answered Sep 05 '12 at 07:56

If you can't filter the Textbox, you have to filter the data in the Postback .

Use Server.HtmlEncode(your text here) to Escape characters normally used for SQL Injection :

string userInput = @"' or 1=1; -- ";

string encodedString = Server.HtmlEncode(userInput);

the result will be :

&#39; or 1=1; -- &lt;html&gt;

Use Regex to replace invalid characters with space or anything to indicate that the characters was replaced (use *) :

Regex myRegex = new Regex("[\\\'\\\"\\<\\>=]", RegexOptions.Compiled | RegexOptions.IgnoreCase);
string userInput = @"' or 1=1; -- <html>";
string encodedString = myRegex.Replace(userInput, "");

the result will be :

or 11; -- html

Use parameters in your SQL queries and validate the values before add the

using (SqlConnection cn = new SqlConnection("Your Connection string here")) {

            using (SqlCommand cmd = new SqlCommand())
            {
                cmd.Connection = cn;
                cmd.CommandType = CommandType.Text;
                cmd.CommandText = "Select * From [User] Where (UserName = @UserName AND Password = @Password)";
                cmd.Parameters.Add("@UserName", SqlDbType.NVarChar).Value = Server.HtmlEncode(txtUserName.Text);
                cmd.Parameters.Add("@Password", SqlDbType.NVarChar).Value = Server.HtmlEncode(txtPassword.Text);
                cn.Open();
                IDataReader reader = cmd.ExecuteReader();
                if (reader.Read())
                {
                    // Your code here
                }
            }
        }

There is custom controls ready to use with options to control what the user can enter in specified text box .
Last advice in Web programming you have to double check (1- Client side using JavaScript) and (2- Server side using your own rules of doubts and concerns).

4b0 · Answer 2 · 2012-09-06T13:27:27.157

0

Possible solutions:

Encrypt sensitive data.
Access the database using an account with the least privileges necessary.
Install the database using an account with the least privileges necessary.
Ensure that data is valid.
Do a code review to check for the possibility of second-order attacks.
Use parameterised queries.
Use stored procedures.
Re-validate data in stored procedures.
Ensure that error messages give nothing away about the internal architecture of the application or the database.

For details see a ref:Injection-Attacks-and-Some-Tips-on-How-to-Prev

edited Sep 06 '12 at 13:27

answered Sep 05 '12 at 06:48

4b0

21,981
30
95
142

I think security is more important then time :) – 4b0 Sep 05 '12 at 08:55

how to prevent from sql injection for text boxes on both sides client / server

2 Answers2