我的WinForm得到一個SQL注入

Question

我的註冊應用程序似乎在我運行SQL注入時，任何人對我有任何快速修復建議，我真的不想改變一切，但爲了使它能夠運行我的第一個項目更新。

string constring = "datasource=127.0.0.1;port=3306;username=root;password=welcome"; 
     string Query = "insert into userdatabase.users (userid, email, passone, passtwo, lastname, firstname) values('" + this.userid_txt.Text + "','" + this.email_txt.Text + "','" + this.passone_txt.Text + "','" + this.passtwo_txt.Text + "','" + this.lastname_txt.Text + "','" + this.firstname_txt.Text + "') ;"; 
     MySqlConnection conDataBase = new MySqlConnection(constring); 
     MySqlCommand cmdDataBase = new MySqlCommand(Query, conDataBase); 
     MySqlDataReader myReader; 
     try 
      { 
       conDataBase.Open(); 
       myReader = cmdDataBase.ExecuteReader(); 
       MessageBox.Show("Welcome to iDSTEM!"); 
       while (myReader.Read()) 
      { 

       } 
      } 
      catch (Exception ex) 
      { 
       MessageBox.Show(ex.Message); 
      } 

該錯誤提示：

你在我的SQL語法錯誤;檢查手冊...第1行

Answer 1

序檢查近視「userdatabase」語法，以避免注射必須使用參數，e.g：

string constring = "datasource=127.0.0.1;port=3306;username=root;password=welcome"; 
string Query = "insert into userdatabase.users (userid, email, passone, passtwo, lastname, firstname) values(@par1,@par2,@par3,@par4,par5,@par6)"; 

    MySqlConnection conDataBase = new MySqlConnection(constring); 
    MySqlCommand cmd = new MySqlCommand(Query, conDataBase); 
    cmd.Parameters.AddWithValue("@par1",this.userid_txt.Text) 
    cmd.Parameters.AddWithValue("@par2",this.email_txt.Text) 
    cmd.Parameters.AddWithValue("@par3",this.passone_txt.Text) 
    cmd.Parameters.AddWithValue("@par4",this.passtwo_txt.Text) 
    cmd.Parameters.AddWithValue("@par5",this.lastname_txt.Text) 
    cmd.Parameters.AddWithValue("@par6",this.firstname_txt.Text) 

    try 
     { 
      conDataBase.Open(); 
      //Execute command 
      cmd.ExecuteNonQuery(); ///I suppose no need to use datareader...since you make insert 
      MessageBox.Show("Welcome to iDSTEM!"); 

    catch (Exception ex) 
      { 
       MessageBox.Show(ex.Message); 
      } 

Answer 2

「修復」這裏是參數。至於捷徑：如果數據庫提供者支持命名參數，dapper可以提供幫助。我不使用MySQL的，所以我不能肯定地說，但如果我們想象是，MySQL支持使用@前綴參數名稱，然後命名參數：

// uses "dapper" (search for "Dapper" on NuGet/Package Manager) 
connection.Execute(
@"insert into userdatabase.users 
     (userid, email, passone, passtwo, lastname, firstname) 
values(@userid, @email, @passone, @passtwo, @lastname, @firstname)", 
    new { userid = this.userid_txt.Text, 
      email = this.email_txt.Text, 
      passone = this.passone_txt.Text, 
      passtwo = this.passtwo_txt.Text, 
      lastname = this.lastname_txt.Text, 
      firstname = this.firstname_txt.Text});