Using Parameterized Queries to avoid SQL Injection In C# .Net

An SQL injection attack consists of insertion or "injection" of an SQL query via the input data from the client to the application. Attackers potentially use SQL Injection to:

• -Logging into your applicatiob by Bypassing the authentication.
• -Gaining access to your sensitive information in the database.
• -Tampering or destroying data.

There are two complementary and successful methods of mitigating SQL Injection attacks:

• -Parameterized queries using bound, typed parameters.
• -Careful use of parameterized stored procedures.

So one common use of such queries is explained in the below example written in Dot Net, which uses Parameterized queries for the variables declared with initial @. And also you can avoid the error caused by Apostophe (') in the variable if you are updating a table.

Like if you have a variable like O'Connor then you app will throw an error, which can be avoided by the use of Parameterized query.

It is one of the best way to avoid hacking.

Check the example below.

StringBuilder sql = new StringBuilder();

sql.AppendLine("UPDATE TableCustomer Set ");

sql.AppendLine("Address = @Address");

sql.AppendLine(", Phone= @Phone");

sql.AppendLine("WHERE CustomerID= @rid");

List<SqlParameter> _sqlCommand = new List<SqlParameter>();

_sqlCommand.Add(new SqlParameter("@Addresss", "SouthPort 22/7"));

_sqlCommand.Add(new SqlParameter("@Phone", 1234567890));

_sqlCommand.Add(new SqlParameter("@rid", rid));

dt.ExecuteSqlCommand(conn, _sqlCommand, sql.ToString());

public void ExecuteSqlCommand(string Conn, List<SqlParameter> parameters, string cmdText)

   {

         using (SqlConnection connection = new SqlConnection(Conn))

         {

          connection.Open();

          SqlCommand command = new SqlCommand(cmdText, connection);

          command.CommandType = CommandType.Text;

          if (parameters != null)

         //foreach (SqlParameter _params in parameters)

           command.Parameters.AddRange(parameters.ToArray());

         command.ExecuteNonQuery();

          }

        

    }