Improving Web Application Security: Threats and - CGISecurity

614 Part V: Assessing Your SecuritySQL InjectionYour code is vulnerable to SQL injection attacks wherever it uses input parametersto construct SQL statements. As with XSS bugs, SQL injection attacks are caused byplacing too much trust in user input and not validating that the input is correct andwell-formed.The following process helps you locate SQL injection vulnerabilities:1. Look for code that accesses the database.Scan for the strings “SqlCommand,” “OleDbCommand,” or “OdbcCommand.”2. Check whether the code uses parameterized stored procedures.Stored procedures alone cannot prevent SQL injection attacks. Check that yourcode uses parameterized stored procedures. Check that your code uses typedparameter objects such as SqlParameter, OleDbParameter, or OdbcParameter.The following example shows the use of a SqlParameter:SqlDataAdapter myCommand = new SqlDataAdapter("spLogin", conn);myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;SqlParameter parm = myCommand.SelectCommand.Parameters.Add("@userName", SqlDbType.VarChar,12);parm.Value=txtUid.Text;The typed SQL parameter checks the type and length of the input and ensures thatthe userName input value is treated as a literal value and not as executable code inthe database.3. Check that your code uses parameters in SQL statements.If you do not use stored procedures, check that your code uses parameters in theSQL statements it constructs, as shown in the following example:select status from Users where UserName=@userNameCheck that the following approach is not used, where the input is used directly toconstruct the executable SQL statement using string concatenation:string sql = "select status from Users where UserName='"+ txtUserName.Text + "'";4. Check whether or not your code attempts to filter input.A common approach is to develop filter routines to add escape characters tocharacters that have special meaning to SQL. This is an unsafe approach, and youshould not rely on it because of character representation issues.