安全地將數據插入SQL表並避免sql插入錯誤

Question

MyI創建了一個應從數據收集信息的表單。這個數據可能包括隨機字符，包括「'等。我的問題是我如何安全地插入數據，而沒有SQL注入攻擊，我可以在哪裏插入轉義字符，以便這種形式不會拋出錯誤，每當一個字符像'」/和等等被插入。

這是到目前爲止我的代碼：

public string InsertRecordSet() 
    {   

     source = new FileInfo(@"c:\scripts\db_connection.txt"); 
     stream = source.OpenText(); 
     String text = stream.ReadLine(); 
     stream.Close(); 
     String uid = text.Substring(0, text.IndexOf(":")); 
     String pw = text.Substring(text.IndexOf(":") + 1, (text.Length - uid.Length - 1)); 
     String connectionString = "dsn=" + "db" + "; uid=" + uid + "; pwd=" + pw + ";"; 
     String statement = "INSERT INTO table (SubmitDate, FirstName, LastName, Email, Phone, Major, Description, HearAbout) VALUES (@SubmitDate, @FirstName, @LastName, @Email, @Phone, @Major, @Description, @HearAbout)";      

     conn = new OdbcConnection(connectionString); 

     command = new OdbcCommand(statement, conn); 

     command.Parameters.AddWithValue("@SubmitDate", DateTime.Now); 
     command.Parameters.AddWithValue("@FirstName", txtFname.Text); 
     command.Parameters.AddWithValue("@LastName", txtLname.Text); 
     command.Parameters.AddWithValue("@Email", txtEmail.Text); 
     command.Parameters.AddWithValue("@Phone", txtPhone.Text); 
     command.Parameters.AddWithValue("@Major", txtMajor.Text); 
     command.Parameters.AddWithValue("@Desciption", txtDescription.Text); 
     command.Parameters.AddWithValue("@HearAbout", txtMaxwell.Text); 

     conn.Open(); 
     try 
     {    
      command.ExecuteNonQuery(); 
      return "true"; 
     } 
     catch (OdbcException oe) 
     { 
      _dbError = true; 
      Session.Contents.Add("USIFormException", oe); 
      return (oe.ToString()); 
     } 
     finally 
     { 
      conn.Close(); 
     } 
    } 

Answer 1

SQL注入的保護，不使用內聯SQL，而是使用參數化的SQL。

參數化的SQL防止SQL注入，因爲它只允許值（或參數）成爲字符串的一部分，而不是任何東西。例如，您的參數化SQL字符串中不能有DROP TABLE xyz，因爲Command對象知道這不是合法的參數值。

因此，不是這樣的代碼：

String statement = "INSERT INTO MyTable(SubmitDate, FirstName, LastName, Email, Phone, Major, Description, HearAbout)";      
statement += "VALUES ("; 
statement += "'" + DateTime.Now.ToShortDateString() + "',"; 
statement += "'" + txtFname.Text + "', "; 

conn = new OdbcConnection(connectionString); 

command = new OdbcCommand(statement, conn); 

你應該有這樣的代碼：

String statement = String statement = "INSERT INTO MyTable(SubmitDate, FirstName, LastName, Email, Phone, Major, Description, HearAbout) VALUES (@SubmitDate, @FirstName)"; 

command.Parameters.Add("@SubmitDate", DateTime.Now.ToShortDateString()); 
command.Parameters.Add("@FirstName", txtFname.Text); 

注：參數化查詢不能完全保護您免受SQL注入，如果你的數據庫邏輯是做動態SQL，所以也要避免這種情況。

Answer 2

您應該使用參數化的值。

string query = "INSERT INTO MyTable(SubmitDate, FirstName, LastName, Email, Phone, Major, Description, HearAbout)";      
query += " VALUES (@SubmitDate, @FirstName, @LastName, @EMail, @Phone, @Major, @Description, @HearAbout)"; 
conn = new OdbcConnection(connectionString); 
command = new OdbcCommand(query, conn); 
command.Parameters.AddWithValue("@SubmitDate", DateTime.Now.ToShortDateString()); 
command.Parameters.AddWithValue("@FirstName", txtFname.Tex); 
... 

conn.Open(); 
command.ExecuteNonQuery(); 

http://msdn.microsoft.com/en-us/library/system.data.odbc.odbccommand.aspx

http://msdn.microsoft.com/en-us/library/system.data.odbc.odbcparametercollection.aspx