SQL injection-proofing TextBoxes

问题

I've found some tutorials on this already, but they aren't exactly what I'm looking for, I can use the following for username fields and password fields

Private Sub UsernameTextBox_KeyPress(ByVal sender As Object, ByVal e As System.Windows.Forms.KeyPressEventArgs) Handles UsernameTextBox.KeyPress
    If Char.IsDigit(e.KeyChar) OrElse Char.IsControl(e.KeyChar) OrElse Char.IsLetter(e.KeyChar) Then
        e.Handled = False
    Else
        e.Handled = True
    End If
End Sub

But for an email field how would I go about protecting against SQL injection for that textbox, as some email accounts have periods or dashes in them?

Update: Below is an example of an insert statement I use.

Dim con As SqlConnection
con = New SqlConnection()
Dim cmd As New SqlCommand
 Try
  con.ConnectionString = "Data Source=" & Server & ";Initial Catalog=" & Database & ";User ID=" & User & ";Password=" & Password & ";"
  con.Open()
  cmd.Connection = con
  cmd.CommandText = "INSERT INTO TB_User(STRUserID, password, Email) VALUES('" & UsernameTextBox.Text & "', '" & MD5Hash(PasswordTextBox.Text) & "', '" & EmailTextBox.Text & "')"
  cmd.ExecuteNonQuery()
Catch ex As Exception
  MessageBox.Show("Error while inserting record on table..." & ex.Message, "Insert Records")
Finally
  con.Close()
End Try

So I need to run this with parametrized queries rather than how I'm doing it now?

回答1:

Instead of filtering out "invalid" data from user input, consider using parametrized queries and not putting user input directly into your queries; that's very bad form.

To run your current query using parameters, it's pretty easy:

Dim con As New SqlConnection()
Dim cmd As New SqlCommand()

Try
    con.ConnectionString = "Data Source=" & Server & ";Initial Catalog=" & Database & ";User ID=" & User & ";Password=" & Password & ";"
    con.Open()
    cmd.Connection = con
    cmd.CommandText = "INSERT INTO TB_User(STRUserID, password, Email) VALUES(@username, @password, @email)"
    cmd.Parameters.Add("@username", SqlDbType.VarChar, 50).Value = UsernameTextBox.Text
    cmd.Parameters.Add("@password", SqlDbType.Char, 32).Value = MD5Hash(PasswordTextBox.Text)
    cmd.Parameters.Add("@email", SqlDbType.VarChar, 50).Value = EmailTextBox.Text
    cmd.ExecuteNonQuery()
Catch ex As Exception
    MessageBox.Show("Error while inserting record on table..." & ex.Message, "Insert Records")
Finally
    con.Close()
End Try

All you have to do is use cmd.Parameters.Add with a parameter name and the right database type (the ones I guessed probably don't match up, so you'll want to change them), then set the value to the value you want used in the query. Parameter names start with an @.

回答2:

It doesn't depend on the textbox. Don't compose a sql sentence joining strings like this:

"SELECT * FROM User WHERE UserName=" + tbName.Text + ...

Use stored procedures or parameterized queries and you'll be safe from SQL injection.

When you use parameters, the textbox content is used as a value, so it doesn't matter what it contains.

回答3:

Use a parametrized query like this:

Using conn = New SqlConnection("some connection string")
    Using cmd = New SqlCommand("SELECT Password FROM tblUser WHERE UserName = @Name", conn)
        cmd.Parameters.Add(New SqlParameter("Name", UsernameTextBox.Text))
        conn.Open()
        Dim password As String = DirectCast(cmd.ExecuteScalar(), String)
        Console.WriteLine(password)
    End Using
End Using

This is injection safe!

来源：https://stackoverflow.com/questions/9813124/sql-injection-proofing-textboxes

标签

sql

vb.net

sql-injection