Does asp.net protect against sql injection attacks?

No. As long as you're supplying the SQL, it's up to you to be smart in how you use the controls.

No. As long as you're supplying the SQL, it's up to you to be smart in how you use the controls. That usually means sanitizing input and using Parameterized Queries or Stored Procedures over dynamic SQL strings.

If the control is generating the queries for you (like the Membership Controls, etc. ) then you're well protected.

1 So when using standard ASP controls like asp:TextBox and rolling your own SQL statements in the code behind their is zero safety. When using preconfigured controls like asp:datagrid which hooks up to an asp:sqldatasource then you are protected. – mrtsherman Feb 28 at 16:49 @mrtsherman - Correct.

– Justin Niessner Feb 28 at 16:52 2 @mrtsherman - I would add that if you use parameterization in the codebehind, it's just as secure as the sqldatasource version. And it's possible to set up a sqldatasource without parameterizing it, which is just as unsafe as doing it in the codebehind. So parameterization is the key.

– Justin Morgan Feb 28 at 17:06.

Most ASP. Net controls (except for DataGrid) do not use SQL at all. If you have your own SQL in your code (using SqlCommands), you don't get any free protection; you need to use parameters.

The few controls that do use SQL (SqlDataSource and the membership framework) do use parameters and are safe against injection.

ASP. NET does not protect against SQL injections! ASP.NET is just the framework for web applications and it does not dictate in what way you access your database.

It depends on how you implement your data access: If you are using ADO. NET, and are building your SQL queries as strings, then you have to sanitize any user-input to be safe from injections. If you are using ADO.

NET and use SqlParameters, then I think you are safe against injections. If you are using an ORM tool for data access, then I'd say you are safe (at least when using the common ones) If you are using DataSets, then you are probably safe as well. If you are using some 3rd-party databound controls, then I hope they are taking care of protecting against SQL injections Probably I forgot to mention a lot in my answer, but you can see that the answer is: "it depends.

Yes and no. ADO. NET offers what I consider very good support for parameterization, and when done properly, the values you use as parameters will be automatically sanitized to prevent SQL injection.So you can easily add parameters to a SqlCommand or SqlDataSource without worrying too much about what's in them in most cases (see below).

However, as with any SQL integration, you still need to pay attention to what you're doing. Any string you get from an unsafe source must be parameterized if you want to take advantage of this capability. If you paste it verbatim into the query text, you will have bypassed ADO.

NET's security features. Furthermore, if you take SQL code, put it in a parameter, and pass it to a SQL EXEC statement, you've also defeated the purpose (and yes, I have seen this done). So to recap... Secure: sqlCommand.

CommandText = "select * from product where name = @name"; sqlCommand.Parameters. AddWithValue("name", txtName. Text); Not so much: sqlCommand1.

CommandText = "select * from product where name = " + txtName. Text; sqlCommand2. CommandText = "exec(@sql)"; sqlCommand2.Parameters.

AddWithValue("sql", "select * from product where name = " + txtName. Text).

No idea why I typed eval instead of exec. Fixed. – Justin Morgan Feb 28 at 19:39 Your sqlCommand2 example is a nice one.

The CommandText is completely parameterized and still we're under attack. Hopefully never ever did this IRL :-) – Steven Mar 2 at 11:14 @Steven: I wish that were the case. This is almost exactly what I saw IRL, and I cried a little when I saw it.

– Justin Morgan Mar 2 at 15:56.

If you always use SqlParameters, and never concatenate user input into SQL, you should be safe. You can use SqlParameters without stored procedures too.

No, ASP. Net does not protect against SQL Injections. The MS shipped code for the ASP.NEt controls is supposed to be SQL Injection free, but this does not prevent all problems one developer can corner himself into.

The best defense is a good understanding of SQL Injection and careful coding. When this is unattainable, for whatever reasons, there are tools that can help like Microsoft Code Analysis Tool . NET (CAT.

NET). This is a free VS plug-in that can analyze the generated assemblies and detect SQL Injection, XSS and XPath injection risks. Such a tool is not bulletproof, but is much better than nothing.

Thank-you. I will keep this tool in mind. – mrtsherman Feb 28 at 20:20 I found this tool very unhelpful.It didn't even find the simplest form of SQL injection such as: var cmd = con.CreateCommand();cmd.

CommandText = "UPDATE T SET V = '" + text + "'";. This tool has a long way to go. – Steven Mar 2 at 16:35.

Partially. There is a filter which is turned on by default which makes constructing an SQL injection attack difficult unless it's turned off. The method which many ASPNET applications use to access MSSQL databases also makes them generally resistant to SQL injection attacks.

But it is still POSSIBLE to create a vulnerable application if you are careless enough.

– mrtsherman Feb 28 at 16:51 @mrtsherman - I didn't read that as referring to the connection itself, but the whole SqlClient stack and its security capabilities. @MarkR, maybe some elaboration is in order? – Justin Morgan Feb 28 at 17:08 Many applications use either a command object with parameters, or a dataset (datarow, etc) object which then generates parameterised queries internally.

These patterns are not susceptible to SQL injections. Of course if you ignore those and write your own SQL, you are at risk, but still protected (somewhat) by the request filter which is turned on by default. – MarkR Feb 28 at 17:38 That's about what I thought you meant.

+1 from me. – Justin Morgan Feb 28 at 17:52.

I cant really gove you an answer,but what I can give you is a way to a solution, that is you have to find the anglde that you relate to or peaks your interest. A good paper is one that people get drawn into because it reaches them ln some way.As for me WW11 to me, I think of the holocaust and the effect it had on the survivors, their families and those who stood by and did nothing until it was too late.