How to Secure SQL in C# ASP.NET

Question

I have the following code:

    [WebMethod]
    public static string addNewNote(string id, string txt)
    {
        Guid parentId = new Guid(id);
        DbProviderFactory dbf = DbProviderFactories.GetFactory();
        using (IDbConnection con = dbf.CreateConnection())
        {
            con.Open();
            using (IDbTransaction trn = con.BeginTransaction())
            {

                Guid noteId = Guid.Empty;
                SqlProcs.spNOTES_WebForms
                        (ref noteId,
                        parentId,
                        "Files",
                        "Client Note",
                        txt,
                        true
                        );
            }
        }
        return "";
    }

In other languages such as PHP, there exist functions such as strip_tags or addslashes or mysqlrealescapestring that would sanitize or otherwise clean client-based variables before inserting them into the database.

Do any such functions exist, or are any such functions required in C# ASP.NET. I am already using a stored procedure, as you can see.

I don't know, but in this case I am using a stored procedure so I am not sure I can use SQL stuff. I was thinking I would just be able to sanitize the data in C#, first. — user1477388
– user1477388, Commented Feb 13, 2013 at 19:34

Andrew Walters · Accepted Answer · 2013-02-13 19:34:48Z

4

If you use parametrized queries .Net will handle the variable sanitation for you.

answered Feb 13, 2013 at 19:34

Andrew Walters

4,8036 gold badges37 silver badges49 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

user1477388 Over a year ago

My stored procedure generated the following code IDbDataParameter parID = Sql.AddParameter(cmd, "@ID" , gID ); (for example). Are you saying this is safe to use as is?

user1477388 Over a year ago

May I ask, after having looked at msdn.microsoft.com/en-us/library/…, where does it say that this sanitizes incoming data? Thanks.

Andy Refuerzo Over a year ago

Read here in the Use Type-Safe SQL Parameters section: msdn.microsoft.com/en-us/library/ms161953(SQL.105).aspx input is treated as a literal value instead of as executable code

user1477388 Over a year ago

Alright, I guess I can trust to leave it as is, then. Thanks!

Collectives™ on Stack Overflow

How to Secure SQL in C# ASP.NET

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related