Control SQL injection in MVC

Question

It's my first time developing using MVC and I want to make it secure.

When I use HtmlEncode it converts the String to the equivalent HTML String.

The user can enter in the search for example ali' or ali-- and they exist in my database. How to control my search and login from SQL injection please?

Also any tutorial or best practice to prevent script injection?

Solution 1

LINQ and Entity Framework already check for SQL Injection for you.

But you should read the documentation anyhow:

LINQ MSDN Link (section SQL-Injection Attacks)

Entity Framework MSDN Link (section Security Considerations for Queries)

Hope it helps!

Solution 2

As long as you use parameterized queries or a ORM like NHibernate or Entity Framework you don't have to do anything to prevent SQL injection. Parameters are passed to the server outside the actual SQL statement, as part of the RPC call to the server. Most ORMs use parameterized queries for performance reasones, so they are not vulnerable to SQL injection.

SQL Injection is possible only if you create a SQL statement by concatenating string values.

That said, you still have to be wary of user input to prevent script injection attacks. Fortunately, ASP.NET MVC already provides a request validation mechanism (see Understanding Request Validation).

Solution 3

If you use LINQ to perform your database queries, it eliminates that kind of SQL injection risks for you.

Comments

[AMH]

thanks does it support ROM databases , what about script injection please

[Cacho Santa]

@AMH I believe that should be another question, but this link could be helpful: asp tutorials

[AMH]

which you prefer please LINQ or EF

[AMH]

but I tired to drop database I know by passing values by parameters

[Cacho Santa]

In my particular case I prefer EF, but I don't know what are you trying to build... Actually I made my decision reading this

[AMH]

I have one database that contains my website, and will connect, add, delete from it

[Panagiotis Kanavos]

No matter what you pass to the parameter (and by parameter I meand a DbParameter-derived object like SqlParameter (msdn.microsoft.com/en-us/library/…), it will be passed to the server as a simple string. It is never executed. You can still get into trouble if you use the stored value to construct a SQL statement by string concatenation in some other part of your application.

[Cacho Santa]

let us continue this discussion in chat