Improving Web Application Security: Threats and - CGISecurity

378 Part III: Building Secure Web ApplicationsUsing the Parameters Collection with Dynamic SQLIf you cannot use stored procedures, you can still use parameters, as shown in thefollowing code fragment:SqlDataAdapter myCommand = new SqlDataAdapter("SELECT au_lname, au_fname FROM Authors WHERE au_id = @au_id", conn);SqlParameter parm = myCommand.SelectCommand.Parameters.Add("@au_id",SqlDbType.VarChar, 11);parm.Value = Login.Text;Using Parameter BatchingA common misconception is that if you concatenate several SQL statements to senda batch of statements to the server in a single round trip, then you cannot useparameters. However, you can use this technique if you make sure that parameternames are not repeated. You can easily do this by adding a number or some otherunique value to each parameter name during SQL text concatenation.Using Filter RoutinesAnother approach used to protect against SQL injection attacks is to develop filterroutines that add escape characters to characters that have special meaning to SQL,such as the single apostrophe character. The following code fragment illustrates afilter routine that adds an escape character:private string SafeSqlLiteral(string inputSQL){return inputSQL.Replace("'", "''");}The problem with routines such as this and the reason why you should not rely onthem completely is that an attacker could use ASCII hexadecimal characters to bypassyour checks. You should, however, filter input as part of your defense in depthstrategy.Note Do not rely on filtering input.Using LIKE ClausesNote that if you are using a LIKE clause, wildcard characters still need escapecharacters. The following code fragment illustrates this technique:s = s.Replace("[", "[[]");s = s.Replace("%", "[%]");s = s.Replace("_", "[_]");