query using value from request gives no result while it should

Asked Apr 23 '18 at 04:44

Active Apr 23 '18 at 05:16

Viewed 53 times

I have a javascript file that will send a value to a json file that has c# in there and sql queries to retrieve from the database.

I already ensured that the value has been retrieved, but my query doesn't give any result while it should.

JS:

$.postJSON('/path/path/html.aspx', {
            action: 'myAction', id: $(this).val(), sectiontext: chosensection
        }, function (j) {

          //some func

        });

    });

this above code in JS that will send values to html.aspx, values are sent im sure. But, when I use it in the query as request["chosensection"] it gives no result

and when i use a string that has the same value as request["sectiontext"] gives result.

edited Apr 23 '18 at 05:16

asked Apr 23 '18 at 04:44

Yura

What if you try a "chosentext" of `'; DROP TABLE STUDENTS; -- `? **Please please please** parameterize your SQL queries if you don't want to be a victim of SQL injections such as the above. – ProgrammingLlama Apr 23 '18 at 04:47
please explain, why would i drop the table? – Yura Apr 23 '18 at 04:47
Why wouldn't a malicious user? – ProgrammingLlama Apr 23 '18 at 04:49
is there anything wrong in my question syntax? – Yura Apr 23 '18 at 04:50
Do you understand the point I'm making? Please read [this](https://stackoverflow.com/questions/17509169/parameterized-queries-vs-sql-injection) – ProgrammingLlama Apr 23 '18 at 04:51
1

John is highlighting that your code is vulnerable to Sql injection attack. – Richardissimo Apr 23 '18 at 04:51
No, honestly... – Yura Apr 23 '18 at 04:52
@Richard Well, I tried... – ProgrammingLlama Apr 23 '18 at 04:53
@Yura your question is now worse off for that edit. – ProgrammingLlama Apr 23 '18 at 04:55
@Yura, Why you removed the code ? please provide more code more than that queries... – Aria Apr 23 '18 at 04:55
thanks i edited it. Now help me with this issue lol – Yura Apr 23 '18 at 04:55
The problem was with your posted code, not the fact that you included it in the question. – Richardissimo Apr 23 '18 at 04:56
@john omg the issue is just in that part, the query part why would i need to provide code – Yura Apr 23 '18 at 04:57
Because an [mcve] is expected. You didn't have one before, but now your question is even worse because you don't even have any code in it. I wouldn't be surprised if the way your building your SQL query is the source of your problem, either. – ProgrammingLlama Apr 23 '18 at 04:57
1

You need to provide the code so people can help you. How can they help you if they can't see what you're doing? – Richardissimo Apr 23 '18 at 04:58
1

@Richard ideally OP would post the full code that they're using to make the query, since the query looked fine aside from being constructed in a way that leaves OP open to SQL injection. – ProgrammingLlama Apr 23 '18 at 05:00
EDITED. how is it now? – Yura Apr 23 '18 at 05:05
I note in your javascript that your variable name is "sectiontext", but in C# it's "chosensection". – ProgrammingLlama Apr 23 '18 at 05:09
sorry it's actually sectiontext. Edited – Yura Apr 23 '18 at 05:17
Are you sure? Because the code you originally posted (before you removed it) had it as `chosentext`? (And you still left another copy of it to fix in the question) – Richardissimo Apr 23 '18 at 05:20
yes i'm sure 100% – Yura Apr 23 '18 at 05:22
i even stored the request's value in a string and made sure it's correct so why it's not retrieveing from database – Yura Apr 23 '18 at 05:23
1

Just to be clear, your original post had `LIKE '%" + Request[chosentext] + "%'` not `sectiontext` or `chosensection`. Clearly, `chosentext` is a variable, so could have any value - you haven't shown us what value. Put a breakpoint in your code after the string is constructed. I guarantee that either the query is different, or it's not looking at the database that you thought. – Richardissimo Apr 23 '18 at 05:32
@Yura Given how you're generating your SQL, can you use the debugger to extract the completed SQL query that results from your request? – ProgrammingLlama Apr 23 '18 at 05:32
the thing wrong was that the string sent had some white space at the end that's why the query doesn't retrieve anything i had to remove the last char which is white space. chosentext = chosentext .Remove(chosentext .Length - 1); – Yura Apr 24 '18 at 04:43

query using value from request gives no result while it should

0 Answers0