Improving Web Application Security: Threats and - CGISecurity

390 Part III: Building Secure Web ApplicationsLogging ExceptionsYou should also log details from the SqlException class. This class exposes propertiesthat contain details of the exception condition. These include a Message property thatdescribes the error, a Number property that uniquely identifies the type of error, anda State property that contains additional information. The State property is usuallyused to indicate a particular occurrence of a specific error condition. For example, if astored procedure generates the same error from more than one line, the Stateproperty indicates the specific occurrence. Finally, an Errors collection containsSqlError objects that provide detailed SQL server error information.The following code fragment shows how to handle a SQL Server error condition byusing the SQL Server .NET Framework data provider:using System.Data;using System.Data.SqlClient;using System.Diagnostics;// Method exposed by a Data Access Layer (DAL) Componentpublic string GetProductName( int ProductID ){SqlConnection conn = new SqlConnection("server=(local);Integrated Security=SSPI;database=products");// Enclose all data access code within a try blocktry{conn.Open();SqlCommand cmd = new SqlCommand("LookupProductName", conn );cmd.CommandType = CommandType.StoredProcedure;cmd.Parameters.Add("@ProductID", ProductID );SqlParameter paramPN =cmd.Parameters.Add("@ProductName", SqlDbType.VarChar, 40 );paramPN.Direction = ParameterDirection.Output;cmd.ExecuteNonQuery();// The finally code is executed before the method returnsreturn paramPN.Value.ToString();}catch (SqlException sqlex){// Handle data access exception condition// Log specific exception detailsLogException(sqlex);// Wrap the current exception in a more relevant// outer exception and re-throw the new exceptionthrow new Exception("Failed to retrieve product details for product ID: " +ProductID.ToString(), sqlex );}