sql injection

این دو تا جواب رو بخونید : 

1 :

Basically, when you perform a SQLCommand using SQLParameters, the parameters are never inserted directly into the statement. Instead, a system stored procedure called sp_executesql is called and given the SQL string and the array of parameters.

When used as such, the parameters are isolated and treated as data, instead of having to be parsed out of the statement (and thus possibly changing it), so what the parameters contain can never be "executed". You'll just get a big fat error that the parameter value is invalid in some way.

2:

A easier-to-understand, and a more general answer goes like this:

Imagine a dynamic SQL query:

sqlQuery='SELECT * FROM custTable WHERE User=' + Username + ' AND Pass=' + password

A simple SQL injection would be just to put the Username in as ' OR 1=1--

This would effectively make the SQL query:

sqlQuery='SELECT * FROM custTable WHERE User='' OR 1=1-- ' AND PASS=' + password

This says select all customers where their username is blank ('') or 1=1, which is a boolean, equating to true. It then uses -- to comment out the rest of the query. So this will print out the entire customer table, or enable you to do whatever you want with it.

Now parameterized queries do it differently, with code like:

sqlQuery='SELECT * FROM custTable WHERE User=? AND Pass=?' parameters.add("User", username) parameters.add("Pass", password)

where username and password are variables pointing to the associated inputed username and password.

Now at this point, you may think, this doesn't change anything at all. Surely you could still just put into the username field something like Nobody OR 1=1'--, effectively making the query:

sqlQuery='SELECT * FROM custTable WHERE User=Nobody OR 1=1'-- AND Pass=?'

And this would seem like a valid argument. But, you would be wrong.

The way parameterized queries work, is that the SQL query is sent as a query, and the database knows exactly what this query will do, and only then will it insert the username and passwords merely as values. This means they cannot affect the query, because the database already knows what the query will do. So in this case it would look for a username of Nobody OR 1=1'-- and a blank password, which should come up false.

میشه گفت بله ، پاراگراف آخر داره همین رو میگه که اول خود Query گرفته میشه و باقی فقط به عنوان پارامتر میان و نمی تونن query رو تغییر بدن.

از یه کتاب ترجمه شده این رو آوردید ؟ google واضحتر ترجمه می کنه.

احتمالا منظورش literal string بوده که بین دو تا (') میاد.

ممنون.

یعنی اول گوئری ؟='SELECT * FROM custTable WHERE User=? AND Pass') تو sql به عنوان کد اجریی پردازش میشه واون دیتایی که بهش ارسال میشه به عنوان متغییر میبینه درسته؟

ما تو کتاب زبان های برنامه نویسی دانشگاه یه بحثی داشتم راجب توابع که تو stack قرار میگیره. میگفتیم پارامترها توقسمت داده . کد اجرایی تو قسمت کد و... .یعنی این برا سوال ما هم صادقه؟

ممنون که جواب دادید.

در کل سوال من اینه. تو sql injection کوئری داینامیک ایمن نیست.گفتن به جای این از گوئری پارامتری استفاده کنید.سوال من اینکه این کوئری پارامتری چجوری باعث تزریق sql نمیشه؟

var sql = "select * from OrdersTable where ShipCity = '" + ShipCity + "'"; کوئری داینامیک
------------------------------------
var sql = "select * from OrdersTable where ShipCity = '@ShipCity ";  
SqlParameter parm = myCommand.SelectCommand.Parameters.Add("@ShipCity",  کوئری پارامتری
     SqlDbType.VarChar, 11);

ممنون مهندس