From the course: ASP.NET: Security
Unlock the full course today
Join today to access over 23,200 courses taught by industry experts.
SQL injection with ADO.NET
From the course: ASP.NET: Security
SQL injection with ADO.NET
- [Instructor] Do you remember the OWASP Top Ten List we've had a look at earlier? The number one issue there was injection and there's several kinds of injections. Basically what this point means in 99% of all cases Turns out, this is still a big problem but when I'm conducting security audits that's something I see very rarely so I'm rather quick in covering this and I also have to tweak the application quite a bit in order to make Sequel injection possible from a tech-er. This is code like it was written, I would say, one or two decades ago using ADO.NET and basically we are using string concatenation to assemble a string in SQL syntax. You could also use string.format or other ways of coupling together that string but basically that string is here. It is using a value id which can be supplied by the user and well then basically we create a command and then we execute that command. And that raw SQL that we create here can be manipulated by the user because the user provides the…
Practice while you learn with exercise files
Download the files the instructor uses to teach the course. Follow along and learn by watching, listening and practicing.
Contents
-
-
-
(Locked)
OWASP Top 103m 36s
-
(Locked)
Cross-site scripting (XSS): The attack5m 10s
-
(Locked)
Cross-site scripting (XSS): The defense4m 18s
-
(Locked)
Cross-site scripting (XSS) in JavaScript5m 19s
-
(Locked)
Same-origin policy and CORS5m 12s
-
(Locked)
Enabling CORS in ASP.NET Web API6m 20s
-
(Locked)
SQL injection with ADO.NET3m 56s
-
(Locked)
SQL injection with Entity Framework3m 32s
-
(Locked)
Fixing SQL injection4m 27s
-
(Locked)
Cross-Site Request Forgery (CSRF)4m 40s
-
(Locked)
Defending against CSRF4m 24s
-
(Locked)
-
-
-
-