SQL Injection Attacks and Defense - 2009

Code-Level Defenses • Chapter 8 345
Query lookupUser = session.createQuery(sql);
// Add parameters to SQL query
lookupUser.setString("username", username);
lookupUser.setString("password", password);
// add username
// add password
List rs = lookupUser.list();
The next example shows the use of Hibernate with JDBC-style question mark
placeholders for the parameters. Note that Hibernate indexes parameters from 0, and not 1,
as does JDBC. Therefore, the first parameter in the list will be 0 and the second will be 1.
String sql = "SELECT * FROM users WHERE username=? AND password=?";
Query lookupUser = session.createQuery(sql);
// Add parameters to SQL query
lookupUser.setString(0, username);
lookupUser.setString(1, password);
// add username
// add password
List rs = lookupUser.list();
Parameterized Statements in .NET (C#)
Microsoft .NET provides access to a number of different ways to parameterize statements by
using the ADO.NET Framework. ADO.NET also provides additional functionality, allowing
you to further check the parameters supplied, such as by type-checking the data you are
passing in.
ADO.NET provides four different data providers, depending on the type of database that
is being accessed: System.Data.SqlClient for Microsoft SQL Server, System.Data.OracleClient
for Oracle databases, and System.Data.OleDb and System.Data.Odbc for OLE DB and ODBC
data sources, respectively. Which provider you use will depend on the database server and
drivers being used to access the database. Unfortunately, the syntax for utilizing parameterized
statements differs among the providers, notably in how the statement and parameters are
specified. Table 8.1 shows how parameters are specified in each provider.
Table 8.1 ADO.NET Data Providers, and Parameter Naming Syntax
Data Provider
Parameter Syntax
System.Data.SqlClient @parameter
System.Data.OracleClient :parameter (only in parameterized SQL command text)
System.Data.OleDb Positional parameters with a question mark placeholder (?)
System.Data.Odbc Positional parameters with a question mark placeholder (?)