Hi Team,I am getting SQL Injection issue.Please give some suggestion

Dibyajyoti Palata

public DataTable GetDataTable(string spname,string parameters)
{
DatatTable dt=new DataTable();
try
{
using(sqlcommand cmd=new sqlcommand("",conn))
{
ArrayList aParams;
string[] avalues=parameters.Split(new String[] {"_"},StringSplitOptions.None);
cmd.CommandType=CommandType.StpredProcedure;
cmd.CommandText=spname;
cmd.CommandTimeOut=Convert.ToInt32(ConfigurationManager.AppSettings[CommandTimeOut]);
aParams=GetParameterList(spname);
for(Int32 i=0;i



Note: I am getting SQL Injection issue on this line "  strReader=cmd.ExecureReader();".Please give me some suggestion to resolve this SQL Injection issues.

5 Replies
Know the answer? Post it — somebody with the same question will find it here.

Sign in to answer this question
It is the same account you read, post and publish with — and you will come straight back to this page.
Sign inCreate an account

Muhammad Imran Ansari3y agoPosted Jan 17, 2023, 2:06 PM Accepted answer Hi Dibyajyoti, This code has a major security vulnerability, it does not properly validate or sanitize the user input passed to the stored procedure which could lead to SQL injection attacks. The problem is with the following line: cmd.Parameters.Add(new SqlParameters((String)aParams[i],(String)aValues[i])); I suggest using parameterized queries to protect against SQL injection attacks, also check if the input is valid before using it in SQL statement, and you should also consider logging any errors or exceptions that may occur during the execution of the function. +2
Dibyajyoti Palata3y agoPosted Jan 23, 2023, 5:47 PM for(Int32 i=0;i cmd.Parameters.Add(new SqlParameters((String)aParams[i],(String)aValues[i])); } In above method multiple SP calling based on SP multipule times adding parameter and values.So SQL Injection will prevent. How to avoid sql injection ? Any predefine functions to handle dynamic parameter and value. How to write sanitize method to handle that parameters ? Please guid me. +1
Dibyajyoti Palata3y agoPosted Jan 17, 2023, 1:15 PM I checked stored procedure working fine and also getting expacted output. +1
Naimish Makwana3y agoPosted Jan 16, 2023, 8:09 AM Please refer below link. https://dba.stackexchange.com/questions/127/do-stored-procedures-prevent-sql-injection +1
Sachin Singh3y agoPosted Jan 16, 2023, 7:24 AM There is no issue in the shared code. I guess your stored procedure might have some issue, make sure you are not concatinating values using '+' sign in your stored procedure. +3