Does this code prevent SQL injection?

by

In answer to your direct question: Does this code prevent SQL injection: No

Here’s the proof – push this string through the PrepareString method:

Dim input = "'" & Chr(8) & "; Drop Table TableName; - " & Chr(8) & "-"
Dim output = PrepareString(input)

Console.WriteLine(input)
Console.WriteLine(output)

I modified the GetRecord method you posted to return the fully prepared SQL string rather than get the record from the database:

Console.WriteLine(GetRecord(output))

And this is the output

Input  = ; Drop Table TableName; --
Output="; Drop Table TableName; --
Query  = SELECT * FROM TableName WHERE Key = "'; Drop Table TableName; --'

Add 1 extra line of code:

My.Computer.Clipboard.SetText(input)

And you’ve got the string you need copied right to your clipboard to paste into your input field on the website to complete your SQL injection:

'; Drop Table TableName; - -

[Noting that the control characters have been omitted from the post output by StackOverflow, so you’ll have to follow the code example to create your output]

After the PrepareString method is run, it will have the exact same output – the Chr(8) ASCII code is the backspace which will remove the extra “‘” that you’re appending to mine which will close your string and then I’m free to add whatever I want on the end. Your PrepareString doesn’t see my — because I’m actually using – – with a backspace character to remove the space.

The resulting SQL code that you’re building will then execute my Drop Table statement unhindered and promptly ignore the rest of your query.

The fun thing about this is that you can use non-printable characters to basically bypass any character check you can invent. So it’s safest to use parameterized queries (which isn’t what you asked, but is the best path to avoid this).

More Related Contents:

  1. Does End Using close an open SQL Connection
  2. Update primary key value using entity framework
  3. Parameterized Queries with LIKE and IN conditions
  4. Using “GO” within a transaction
  5. Preventing SQL Injection in ASP.Net
  6. How do I write LINQ’s .Skip(1000).Take(100) in pure SQL?
  7. How can you name the Dataset’s Tables you return in a stored proc?
  8. How can I avoid SQL injection attacks in my ASP.NET application?
  9. Using a variable for table name in ‘From’ clause in SQL Server 2008
  10. For Each Loop in Visual Basic: IndexOutOfRangeException [closed]
  11. Like Operator in Entity Framework?
  12. How should I pass a table name into a stored proc?
  13. How can I solve a connection pool problem between ASP.NET and SQL Server?
  14. Login failed for user ‘DOMAIN\MACHINENAME$’
  15. Yield in VB.NET
  16. How to execute an SSIS package from .NET?
  17. Can I host a Windows Form inside a control
  18. How can I make a single event handler handle ALL Button.Click events?
  19. Does using parameterized SqlCommand make my program immune to SQL injection?
  20. Procedure expects parameter which was not supplied
  21. Where are My.Settings saved in VB 2010 .NET?
  22. Equivalent of MoveNext in VB.NET
  23. How can I create database tables from XSD files?
  24. Shuffling an array of strings in vb.net
  25. Determine if a generic param is a Nullable type
  26. How do I find out which control has focus in .NET Windows Forms?
  27. How do I fill an empty textbox with default text?
  28. variable/property changed event in vb.net
  29. Are nested Try/Catch blocks a bad idea?
  30. Shadows vs Overloads in VB.NET

Leave a Comment