SQL Injection In ASP.Net

Sourabh Somani

7y387.1k15100Article

ASP.NET SQL SQL InjectionSQL Injection in ASP.NETSQL Injection effects

15 Comments

Join the conversation! Your thoughts help the community grow.

Rakesh Raval4y ago
We need a solution, how to secure our API for SQL injection
- Sourabh Somani4y ago
  If you are using asp.net mvc api then just use Entityframe work or other ORMs. If you don't want to use ORMs then use Stored Procs. Make sure you are not using dynamic queries.
Kaushik Roy Chowdhury6y ago
This is all outdated stuff as nobody uses Web Forms these days. The programming world has already left ASP.NET framework and moved to asp.net core where we use EF Core and you don't need to write dynamic SQL queries at all which are open to SQL injection attacks. Say something that's relevant with present day technologies.
- Sourabh Somani6y ago
  BTW, This article is very old I written this article in 2014.
nedam pozabi6y ago
The accompanying files are poorly made and buggy
Khargesh Rajput11y ago
nice
- Sourabh Somani11y ago
  Glad you like this
PATEL UTSAV11y ago
what is this Email='"+Login1.UserName+"'and Password='"+Login1.Password+"' ";
- Sourabh Somani11y ago
  PATEL UTSAV What is this means... It is just a Login control of asp.net and you can also take textbox. What you want to say actually I am not getting you.... can you clear me your question?
Phalguni Bhuyan12y ago
Very beautiful article about sql injection.Can you please explain same thing in ASP.NET MVC
- Sourabh Somani12y ago
  thanks for liking this article..... I will try to make same thing in MVC....
Asif Khan12y ago
nicely explained
- Sourabh Somani12y ago
  Thank you..... :)
Saineshwar Bageri12y ago
nice article
- Sourabh Somani12y ago
  Thanks, Glad you liked it.

About SQL Injection

Many vulnerabilities exist allowing hackers to steal data from organizations and SQL Injection is one of them. It is perhaps one of the most common application layer attack techniques used today. When improper coding of the web application is done then a hacker can inject into SQL commands. By using SQL commands a hacker can steal your data, they can modify your details and they can delete your data permanently.

In simple terms, SQL injection is nothing but it a technique where malicious users can inject SQL commands into an SQL statement, via webpage input and this input can break the security of the web application.

Now we understand how SQL Injection can be done in ASP .NET websites.

Let's take an example. Suppose you have a Login Table inside your database such as follows:

Create table Login
(
id int primary key,
Name varchar(50),
Email varchar(50),
Password varchar(50)
)

Using the code above the output will look like:

And in this table you have some data such as the following.

Insert into Login values(1, 'Sourabh Somani', '[email protected]', 'password');
Insert into Login values(2, 'Shaili Dashora', '[email protected]' 'password');
Insert into Login values(3, 'Divya Sharma', '[email protected]', 'password');
Insert into Login values(4, 'Swati Soni', '[email protected]', 'password');

Using the code above the output will be like:

Now I am creating a Login page using the following code with a Login Control.

<asp:login id="Login1" runat="server" onauthenticate="Login1_Authenticate" width="331px"
backcolor="#F7F6F3" bordercolor="#E6E2D8" borderpadding="4" borderstyle="Solid"
borderwidth="1px" font-names="Verdana" font-size="0.8em" forecolor="#333333"
height="139px">
<InstructionTextStyle Font-Italic="True" ForeColor="Black" />
<LoginButtonStyle BackColor="#FFFBFF" BorderColor="#CCCCCC" BorderStyle="Solid" BorderWidth="1px" Font-Names="Verdana" Font-Size="0.8em" ForeColor="#284775" />
<TextBoxStyle Font-Size="0.8em" />
<TitleTextStyle BackColor="#5D7B9D" Font-Bold="True" Font-Size="0.9em" ForeColor="White" />
</asp:login>

Using the code above the output will be like:

Now double-click on the Login control and generate a Login1_Authenticate event handler.

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
}

And if you write the following code such as the following:

protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
{
SqlConnection con = new SqlConnection(@"Data Source=.\sqlexpress;Initial Catalog=MyDb;Integrated Security=True");
string qry="select * from MyTable where Email='"+Login1.UserName+"'and Password='"+Login1.Password+"' ";
adpt = new SqlDataAdapter(qry,con);
dt = new DataTable();
adpt.Fill(dt);
if (dt.Rows.Count >= 1)
{
Response.Redirect("index.aspx");
}
}

Here index.aspx is another page that will be shown after login.

Now press F5 to run this project. On the run-time we will see the How SQL Injection can be done...?

After running the output will be:

SQL Injection when an attacker doesn't know the username: If the attacker doesn't know what the username is then he/she simply uses a "1=1" concept as in the following example.

Now if we look at our SQL query then that was:

string qry="select * from MyTable where Email='"+Login1.UserName+"'and Password='"+Login1.Password+"' ";

Now see that what we entered as the username inside the TextBox of the login control is ' or 1=1, so after pressing the Log In button your query will look like:

select * from MyTable where Email='' or 1=1--'and Password=''

Here:

SQL Injection when the attacker does know the username: If the attacker does know the username then he will never need to apply the 1=1 rule, he will simply write username + ' in the TextBox and comment out everything following such as in the following.

SQL Injection when attacker knows username

So now depending on the username our query will be like this:

select * from MyTable where Email='[email protected]'--and Password=''

Here:

How SQL Injection can be dangerous

Suppose an attacker knows the information about the SQL, then he can also modify the database. For example, suppose an attacker knows the name of the table. He can then also insert, delete, update, alter and so on command inside the SQL.

For this see the following example.

Example: My table name is MyTable and if I want to delete data from the table then my query will be "Delete from MyTable".

How to apply this query in a TextBox

So by providing the username query above it will look such as the following.

select * from MyTable where Email='' Delete from MyTable --'and Password=''

Here

If you want to check whether or not the data was deleted from the database then just go to SQL Express and select all the data using a selection query as in the following:

This was all about SQL Injection.

Note: Inside an Index.aspx page I have just written the following code:

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="Index.aspx.cs" Inherits="Index" %>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head id="Head1" runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
<div>
<center>
<h1>
HELLO
<br />
C# CORNER
</h1>
</center>
</div>
</form>
</body>
</html>

Output of the Index Page