I'm testing a web page to prevent SQL Injection.Here is my ASPX page source:
<asp:SqlDataSource ID="SqlDataSource_Test" runat="server"
ConnectionString="<%$ ConnectionStrings:Default %>" >
</asp:SqlDataSource>
<asp:GridView ID="GV" runat="server" Visible="False"
DataSourceID="SqlDataSource_Test" ></asp:GridView>
In the code behind:
string ID = Request["id"];
SqlDataSource_Test.SelectCommand = "SELECT * FROM TABLE WHERE id = @ID";
SqlDataSource_Test.SelectParameters.Add(new Parameter("ID", System.Data.DbType.String, ID));
GV.DataBind();
but when I request the page with the url:
http://localhost:5284/details.aspx?id=731974'; update table set name='SQL INJECTION' where ID=1--&p=2
The field "name" is updated to "SQL INJECTION".
How to prevent SQL injection in SqlDataSource control?
