When you do with parameters.add does that prevent SQL injection? In php I use mysql_escape function on each var to escape the strings properly from a user.
I still would like to know how to return a single var, a row and result set to an object and display it. Like I said I am totally new to ASP.
Thanks
Main Topics
Browse All Topics





by: angelIIIPosted on 2007-01-28 at 00:08:44ID: 18413167
>This is one example I got to work, I am not sure if this is a good way or not.
hDbFilenam e=\"C:\\Pr ogram Files\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Da ta\\helpde sk.mdf\";I ntegrated Security=True;Connect Timeout=30;User Instance=True"; '", "''"), email.replace("'", "''"));
;
hDbFilenam e=\"C:\\Pr ogram Files\\Microsoft SQL Server\\MSSQL.1\\MSSQL\\Da ta\\helpde sk.mdf\";I ntegrated Security=True;Connect Timeout=30;User Instance=True";
; me", username ) , email )
there is 1 problem, which is known as SQL injection, in case the parameters (username, email) come from user input.
a quick and dirty solution would be this one:
public void insertUser(string username, string email)
{
string con_string = "Data Source=.\\SQLEXPRESS;Attac
string sql = string.Format(
"INSERT INTO users (username, email) VALUES ('{0}', '{1}')",username.replace("
SqlCommand cm = new SqlCommand(sql, new SqlConnection(con_string))
cm.Connection.Open();
cm.ExecuteNonQuery();
cm.Connection.Close();
}
a more professional solution would be this one, as it also will fine-tune the performance for the database:
public void insertUser(string username, string email)
{
string con_string = "Data Source=.\\SQLEXPRESS;Attac
string sql = "INSERT INTO users (username, email) VALUES (@username, @email )" ;
SqlCommand cm = new SqlCommand(sql, new SqlConnection(con_string))
cm.Parameters.Add("@userna
cm.Parameters.Add("@email"
cm.Connection.Open();
cm.ExecuteNonQuery();
cm.Connection.Close();
}