0

I've been working on an ASP.NET/C# project and ajax, and now that my ajax call works I'd like to make it secure.

For now, it works like this : 

[HttpPost]
public ActionResult CheckReturn(TitreWrapper titreWrap)
{
    string titre = titreWrap.titre;

    var contexte = new intranetEntities();
    var ajax = contexte.evenementiel.SqlQuery("SELECT * FROM evenementiel WHERE titrebri_evenementiel LIKE '%'+titre+'%' ORDER BY datecreation_evenementiel DESC;");
    ViewBag.ajax = ajax;

    return PartialView();
}

which is, I know, extremely insecure.

So I searched, and read about parameterized queries, and tried this :

[HttpPost]
public ActionResult CheckReturn(TitreWrapper titreWrap)
{
    string titre = titreWrap.titre;

    SqlParameter[] param = new SqlParameter[1];
    param[0] = new SqlParameter("@titre", titre);

    var contexte = new intranetEntities();
    var ajax = contexte.evenementiel.SqlQuery("SELECT * FROM evenementiel WHERE titrebri_evenementiel LIKE '%@titre%' ORDER BY datecreation_evenementiel DESC;");
    ViewBag.ajax = ajax;

    return PartialView();
}

which didn't work as intended :( It just changed the query (which is, in a sense, extremely secure now, you can't do anything else than getting the results of the premade query).

I don't know how to do it without deeply changing my code.

Anybody got any idea ?

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
Orsu
  • 405
  • 6
  • 19
  • 2
    What is the whole point of using EF if you still use raw queries like that? Use something like `contexte.evenementiel.Where(x => x.titrebri_evenementiel.Contains(titre)).OrderByDescending(x => x.datecreation_evenementiel)`. – Alex Skalozub Feb 08 '16 at 10:06
  • okay, i did as @Alex Skalozub said, it works, and i guess it's securized. To answer, i use raw sql queries because i find them more "readable" and easier to understand what they do than LINQ (if your example is that) Thanks :) (ps : delete my post if it's a duplicate, i felt like it wasn't but maybe it is) – Orsu Feb 08 '16 at 10:21

0 Answers0