What is the correct syntax?

If you have a little knowledge of SQL-Injection attacks then you must be knowing that your code is not only wrong but also vulnerable to the attack, never build the query by concatenating user inputs, a malicious user may enter a SQL query instead of a username.

Always use a parameterized query or Stored procedures when working with ADO.Net

Note:- cs is connection string and rdr[n] means nth column in DB.

using(SqlConnection con= new SqlConnection(cs)){
SqlCommand cmd= new SqlCommand("select name from clients where clients=@clientName",con);
cmd.Parameters.AddWithValue("@clientName","jhon");
con.Open();
var rdr= cmd.ExecuteReader();
While(rdr.Read()){
System.IO.File.WriteAllText("c:/myFile.txt", string.Format("{0}{1}{2}", rdr[0].ToString(), rdr[1].ToString(), rdr[2].ToString());
);
}
}

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Sachin Singh5y ago
Accepted answer
If you have a little knowledge of SQL-Injection attacks then you must be knowing that your code is not only wrong but also vulnerable to the attack, never build the query by concatenating user inputs, a malicious user may enter a SQL query instead of a username.

Always use a parameterized query or Stored procedures when working with ADO.Net

Note:- cs is connection string and rdr[n] means nth column in DB.
1. using(SqlConnection con= new SqlConnection(cs)){
2. SqlCommand cmd= new SqlCommand("select name from clients where clients=@clientName",con);
3. cmd.Parameters.AddWithValue("@clientName","jhon");
4. con.Open();
5. var rdr= cmd.ExecuteReader();
6. While(rdr.Read()){
7. System.IO.File.WriteAllText("c:/myFile.txt", string.Format("{0}{1}{2}", rdr[0].ToString(), rdr[1].ToString(), rdr[2].ToString());
8. );
9. }
10. }
Valerie Meunier5y ago
Thanks