Improving Web Application Security: Threats and - CGISecurity

394 Part III: Building Secure Web Applications(continued)// Parameters are type checkedSqlParameter parm =cmd.Parameters.Add("@ProductCode",SqlDbType.VarChar,12);parm.Value = productCode;// Define the output parameterSqlParameter retparm = cmd.Parameters.Add("@quantity", SqlDbType.Int);retparm.Direction = ParameterDirection.Output;conn.Open();cmd.ExecuteNonQuery();quantity = (int)retparm.Value;}}catch (SqlException sqlex){// (5) Full exception details are logged. Generic (safe) error message// is thrown back to the caller based on the SQL error code// Log and error identification code has been omitted for claritythrow new Exception("Error Processing Request");}catch (Exception ex){// Log full exception detailsthrow new Exception("Error Processing Request");}return quantity;}// (6) Encrypted database connection string is held in the registryprivate static string GetConnectionString(){// Retrieve the cipher text from the registry; the process account must be// granted Read access by the key's ACLstring encryptedString = (string)Registry.LocalMachine.OpenSubKey(@"Software\OrderProcessing\").GetValue("ConnectionString");// Use the managed DPAPI helper library to decrypt the stringDataProtector dp = new DataProtector(DataProtector.Store.USE_MACHINE_STORE);byte[] dataToDecrypt = Convert.FromBase64String(encryptedString);return Encoding.ASCII.GetString(dp.Decrypt(dataToDecrypt,null));}