Introduction to SQL Injection in ASP.NET

Background

Wikipedia says SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacks.^[1]

Using the code

We are going to use multiple comments in our article and we are going to use C# as our language.

Start

Let us take an example of a code that i came across in some online catalogue, that was for online shooping application for a client. The code look like this and the page ware written too close to something like this.

And the aspx page like this

And when you run the application,it should show you something like this

Now maybe the programmer was happy when he saw that he can search for me :), but now this was a dangerous way of doing things. Let us inject the above application.

SQL Injection Begins

In the above example a bad user(Hacker) might try to temper with the Sql statement. Often, the main reason for a bad user is to get an error message that will expose the name of the tables and the database. Now as you saw above code;the error handling has not been done and the low level message will show and that info will be used to execute other malicious statements against your database and if it’s an online shopping site;the clients credits card info might be exposed. Now let us inject the above. Enter the Following text:

Let look at this one. Enter the following

With the “;” you start an other line. All this will be executed. Now if you check your table, you will not find any data.

Solution

CREATE PROC prc_search
(
@FNAME varchar(20)
)
AS
SELECT * FROM DBO.MEMYSELF WHERE FNAME = @FNAME

And our function should look like this

protected void Show_Data(String strssearch)
{
String strcon = WebConfigurationManager.ConnectionStrings["MYSTRING"].ConnectionString;
SqlConnection con = new SqlConnection(strcon);
SqlCommand cmd = new SqlCommand();
cmd.CommandText = "dbo.prc_search";
cmd.Parameters.Add("@FNAME", SqlDbType.VarChar, 20).Value = strssearch;
cmd.CommandTimeout = 0;
cmd.CommandType = CommandType.StoredProcedure;
cmd.Connection = con;
SqlDataReader reader = null;
 
try
{
con.Open();
reader = cmd.ExecuteReader();
}
catch (SqlException ex)
{
lblMessage.Text = ex.Message.ToString();
}
if (reader.HasRows)
{
GridView1.DataSource = reader;
GridView1.DataBind();
reader.Close();
con.Close();
}
else
{
lblMessage.Text = "There are no Records Available";
}
}

Now if you go and test the injection again , you will see that the user cannot run sql commands again. i have added a label to show trapped exceptions and named it lblMessage.