Click here to Skip to main content
15,891,033 members
Home / Discussions / Database
   

Database

 
General"COM object with CLSID {10020200-EB1C-11CF-AE6E-00AA004A34D5} is either not Pin
leezardd5-May-05 9:23
leezardd5-May-05 9:23 
GeneralRe: "COM object with CLSID {10020200-EB1C-11CF-AE6E-00AA004A34D5} is either not Pin
Dan_P5-May-05 20:14
Dan_P5-May-05 20:14 
GeneralRe: "COM object with CLSID {10020200-EB1C-11CF-AE6E-00AA004A34D5} is either not Pin
leezardd12-May-05 3:51
leezardd12-May-05 3:51 
GeneralRunning Store Proc in Access Pin
mjackson115-May-05 7:49
mjackson115-May-05 7:49 
GeneralDatabase logon Pin
Joey Picerno5-May-05 3:53
Joey Picerno5-May-05 3:53 
GeneralNot DataItem Is Nothing == Only true DURING data binding?! Pin
RabidTommy5-May-05 3:29
RabidTommy5-May-05 3:29 
GeneralValidateing values in Stored Procedures Pin
hhrafn5-May-05 0:07
hhrafn5-May-05 0:07 
GeneralRe: Validateing values in Stored Procedures Pin
Colin Angus Mackay5-May-05 0:21
Colin Angus Mackay5-May-05 0:21 
hhrafn wrote:
for example I'd like to make sure that numbers are actually numbers and username like "joe" isn't something like "'; DROP table;--"

Well, if you are using stored procedure this shouldn't be too much of a problem. You are passing the parameters to the stored procedures correctly, aren't you? I mean your code is something like this:
SqlCommand cmd = new SqlCommand("MyStoredProcName");
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add("@userNameParam", "joe");


If you add parameters in this way you are protected from a first order attack. If your command string is something like
EXEC MyStoredProcName @userNameParam = 'joe'
then you should replace it with code like the first example above.

In your stored procedure you can then have code like this
IF EXISTS (SELECT * FROM UsersTable WHERE UserName = @userNameParam)
BEGIN
    -- Do stuff based on the user existing
END
ELSE
BEGIN
    -- Do stuff based on this being an incorrect user
END


For more information see SQL Injection Attack and Tips on How to Prevent Them[^]

Does this help?


My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More


GeneralPlease help me: need sp4 Pin
Chak4-May-05 15:29
Chak4-May-05 15:29 
GeneralRe: Please help me: need sp4 Pin
Colin Angus Mackay4-May-05 19:37
Colin Angus Mackay4-May-05 19:37 
GeneralProb using Oracle 9i Pin
vishalmishra4-May-05 11:46
vishalmishra4-May-05 11:46 
GeneralRe: Prob using Oracle 9i Pin
Colin Angus Mackay4-May-05 12:00
Colin Angus Mackay4-May-05 12:00 
GeneralRe: Prob using Oracle 9i Pin
vishalmishra4-May-05 12:14
vishalmishra4-May-05 12:14 
GeneralNewbie GROUP BY question Pin
moredip4-May-05 11:01
moredip4-May-05 11:01 
GeneralRe: Newbie GROUP BY question Pin
Colin Angus Mackay4-May-05 11:36
Colin Angus Mackay4-May-05 11:36 
GeneralRe: Newbie GROUP BY question Pin
moredip4-May-05 11:50
moredip4-May-05 11:50 
GeneralRe: Newbie GROUP BY question Pin
Colin Angus Mackay4-May-05 11:57
Colin Angus Mackay4-May-05 11:57 
GeneralRe: Newbie GROUP BY question Pin
moredip4-May-05 12:11
moredip4-May-05 12:11 
GeneralRe: Newbie GROUP BY question Pin
Colin Angus Mackay4-May-05 12:13
Colin Angus Mackay4-May-05 12:13 
GeneralAverage formula with SQL table Pin
Joey Picerno4-May-05 10:20
Joey Picerno4-May-05 10:20 
GeneralRe: Average formula with SQL table Pin
Colin Angus Mackay4-May-05 11:42
Colin Angus Mackay4-May-05 11:42 
GeneralRe: Average formula with SQL table Pin
Joey Picerno4-May-05 15:33
Joey Picerno4-May-05 15:33 
GeneralRe: Average formula with SQL table Pin
Joey Picerno4-May-05 15:45
Joey Picerno4-May-05 15:45 
GeneralRe: Average formula with SQL table Pin
Colin Angus Mackay4-May-05 19:33
Colin Angus Mackay4-May-05 19:33 
GeneralRe: Average formula with SQL table Pin
Joey Picerno5-May-05 3:51
Joey Picerno5-May-05 3:51 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.