flawopen.com/sql-injection/Csharp

इस पेज के मुख्य शब्द

Web Application Security

सुरक्षा अवधारणा (Web Application Security): Core architecture component affected by CWE-89.

CWE-89

सुरक्षा अवधारणा (CWE-89): Standard Common Weakness Enumeration classification for sql-injection-csharp.

Defense-in-Depth

सुरक्षा अवधारणा (Defense-in-Depth): Multi-layered engineering verification and runtime boundary isolation.

हमले का चरण-दर-चरण प्रवाह

सोर्स कोड: कमज़ोर बनाम सुरक्षित कार्यान्वयन

// userId comes straight from the request
var query =
  $"SELECT * FROM Users WHERE Id = {userId}";
var cmd = new SqlCommand(query, connection);
var reader = cmd.ExecuteReader();

// value bound as a parameter
var cmd = new SqlCommand(
  "SELECT * FROM Users WHERE Id = @id",
  connection);
cmd.Parameters.AddWithValue("@id", userId);
var reader = cmd.ExecuteReader();

इंजीनियरिंग और सिस्टम सुरक्षा चेकलिस्ट

• ✓हमेशा SqlCommand.Parameters or Dapper's parameter object — never interpolate values into the query string का उपयोग करें।
• ✓अनुशंसित सुरक्षा नियम: Prefer FromSqlInterpolated() over FromSqlRaw() in EF Core।
• ✓अनुशंसित सुरक्षा नियम: Enable Roslyn analyzer rule CA2100 (or equivalent) in your build।

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• Microsoft Docs — SqlParameterCollection
• Microsoft Docs — EF Core raw SQL queries (FromSqlInterpolated)
• OWASP SQL इंजेक्शन रोकथाम चीट शीट