Beginning Web Development, Silverlight, and ASP.NET AJAX

90
CHAPTER 4 ■ DATA BINDING WITH ASP.NET
Using Parameters in Commands
Now, this is all very well for a fixed SQL statement like the one we had hard-coded to
query for postal code 98011. But what happens if you want the user to specify the postal
code that they are searching for You achieve this using parameters. Thus, you can provide
an application where the user specifies (using text input, request parameters, or
other input mechanisms) what they want, and your application responds accordingly.
Be careful when using parameters in SQL statements that are derived from user
input, as this is a common source of SQL injection attacks. This type of hacker attack
involves a cleverly crafted parameter value on the user’s part and an insecure application
that doesn’t validate user input. This attack can allow a malicious user to access private
data or even destroy your database.
To use a parameter in SQL, you specify a placeholder for the parameter by prefixing
it with the @ character. So, for example, our hard-coded query from earlier could be
changed to this:
sqlComm.CommandText =
"SELECT AddressLine1 FROM Person.Address WHERE (PostalCode = @strZIP)";
Then, before executing, you add the value of the parameter to the command,
like this:
sqlComm.Parameters.Add("@strZIP", strParamZIP);
The value you’ll assign to the parameterized postal code is contained in the variable
strParamZIP. The value can be the result of text input, or, if you prefer, taken directly off
the query string. The code to access it from the query string will look like this:
string strParamZIP = "98011";
if (Request.Params["ZIP"] != null)
strParamZIP = Request.Params["ZIP"];
But if you use code like this, don’t forget to sanitize strParamZIP before passing it to
the database to avoid injection attacks. By sanitize, I mean that you should evaluate the
value contained within strParamZIP and make sure it’s a valid postal code, not some other
(invalid) text.
Now if you run your application, your query string can contain a postal code, and the
query results for that postal code will be displayed. Figure 4-18 shows an example of this
where I used a postal code of 14111.