Databases
StackOverflow2013
Postsdbo
POIs this sql vulnerability in my code?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs this sql vulnerability in my code?
    primarykey
    data
    text
    <p>Is this sql vulnerability in my code?Because I have Parameterized the SQL ,so no sql Injection? anyone give some suggests will appreciate!If yes, How to repair?</p> <p>ASP.NET CODE:</p> <pre><code> public DataTable CompanySearchUser(int pageSize, int currentPage, string whereCondition) { DbParameter[] parms = { DbHelper.MakeInParam("@PageSize",(DbType)SqlDbType.Int,4,pageSize), DbHelper.MakeInParam("@PageNumber",(DbType)SqlDbType.Int,4,currentPage), DbHelper.MakeInParam("@where",(DbType)SqlDbType.NVarChar,500,whereCondition) }; DataTable userlist = DbHelper.ExecuteDataset(CommandType.StoredProcedure, "spCompanySearchUser", parms).Tables[0]; return userlist; } </code></pre> <p>SQL CODE:</p> <pre><code>ALTER PROC [dbo].[spCompanySearchUser] @PageSize INT @PageNumber INT, @where nvarchar(550)--like 'and a=1 ' AS DECLARE @RowStart INT DECLARE @RowEnd INT DECLARE @SQL NVARCHAR(4000) IF @PageNumber &gt; 0 BEGIN SET @PageNumber = @PageNumber - 1 SET @RowStart = @PageSize * @PageNumber + 1; SET @RowEnd = @RowStart + @PageSize - 1; SET @SQL=' WITH AllUsers AS (SELECT UB.UserBaicInfoID, UB.UserName, UB.HighestEducation, UB.Age, UB.Sex, UB.WorkExperience, UB.PositionDesired, UB.UpdateTime, Row_number() OVER (ORDER BY UB.UpdateTime DESC) AS RowNumber From UserBasicInfo UB WHERE ResumeState=1 '+@where+') SELECT * FROM AllUsers WHERE RowNumber &gt;=' + Str(@RowStart) + ' AND RowNumber &lt;= ' + Str(@RowEnd) + '' EXEC sp_executesql @SQL END </code></pre> <p>Is this sql vulnerability in my code?Because I have Parameterized the SQL ,so no sql Injection? anyone give some suggests will appreciate!If yes, How to repair?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USuser1662936
    1. USuser1662936
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COdo not pass the whole `where` condition (or even a part of it verbatim). construct the expression yourself from the passed parameters. check parameters and make sure that they are of expected types before pasting them in to the query.
      singulars
      1. POIs this sql vulnerability in my code?
      1. USakonsu
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload