Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 377Use Type Safe SQL ParametersThe Parameters collection in SQL provides type checking and length validation. Ifyou use the Parameters collection, input is treated as a literal value and SQL does nottreat it as executable code. An additional benefit of using the Parameters collection isthat you can enforce type and length checks. Values outside of the range trigger anexception. This is a healthy example of defense in depth.Important SSL does not protect you from SQL injection. Any application that accesses a databasewithout proper input validation and appropriate data access techniques is susceptible to SQLinjection attacks.Use stored procedures where you can, and call them with the Parameters collection.Using the Parameters Collection with Stored ProceduresThe following code fragment illustrates the use of the Parameters collection:SqlDataAdapter myCommand = new SqlDataAdapter("AuthorLogin", conn);myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;SqlParameter parm = myCommand.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11);parm.Value = Login.Text;In this case, the @au_id parameter is treated as a literal value and not as executablecode. Also, the parameter is type and length checked. In the sample above, the inputvalue cannot be longer than 11 characters. If the data does not conform to the type orlength defined by the parameter, an exception is generated.Note that using stored procedures does not necessarily prevent SQL injection. Theimportant thing to do is use parameters with stored procedures. If you do not useparameters, your stored procedures can be susceptible to SQL injection if they useunfiltered input. For example, the following code fragment is vulnerable:SqlDataAdapter myCommand = new SqlDataAdapter("LoginStoredProcedure '" +Login.Text + "'", conn);Important If you use stored procedures, make sure you use parameters.