SQL Injection

[Arne]

Will the code below protect me from SQL injection in an ASP.Net page?
Dim cmd As SqlCommand
Dim prm As SqlParameter
Dim salary As String
cmd.CommandText = "select salary from employee where name=@name"
prm = New SqlParameter("@name", name.text)
cmd.Parameters.Add(prm)
salary = cmd.ExecuteNonQuery

 

[Cactus Corp.]

Will the code below protect me from SQL injection in an ASP.Net page?
Dim cmd As SqlCommand
Dim prm As SqlParameter
Dim salary As String
cmd.CommandText = "select salary from employee where name=@name"
prm = New SqlParameter("@name", name.text)
cmd.Parameters.Add(prm)
salary = cmd.ExecuteNonQuery

It should.

But it should not be used as a mitigation technique, the name.text
value should first be checked against your acceptation rules.

Best practice would be to make a global static method, checking
validity of an input upon a regular expression.

If (SecurityUtils.IsInputValid(name.Text , "[a-zA-Z]{1,30}")) Then
...do something
End If

antoine

 

[Dominick Baier [DevelopMentor]]

Hello Arne,

yes.

besides that this code sample implies that this application can retrieve
the salary of an arbitrary user in your database....