Re: help me plz

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Jim Hughes (NOSPAMJ3033_at_Hotmail.com)
Date: 03/27/05 

Date: Sat, 26 Mar 2005 16:18:30 -0800

Consistently doing things the correct way is the key to success.

The OP was using a parameteriezed query, but just missed adding the
parameter.

In the case however, as you pointed out, the only thing saving this from
SQL injection attack was the byval num as integer function argument. That
may not have been obvious to the OP for the next function where they were
passing in the username as a string instead of the ID.

"Elton Wang" <anonymous@discussions.microsoft.com> wrote in message
news:192901c53259$cbbb8730$a401280a@phx.gbl...
> Hi Jim,
>
> It's a good point. If field id is type of char or varchar
> (or something similar), it's better to use parameter. For
> type int, there is no large difference.
>
> HTH
>
> Elton Wang
>
>>-----Original Message-----
>>Please don't do that!
>>
>>Dim cm As New SqlCommand("select * from student where
> id=@num")
>>cm.Parameters.Add("@num", num)
>>
>>Search Google for SQL injection attack.
>>
>>Also look into using the Data Access Application Block
> (DAAB) from
>>Microsoft.
>>
>>
>>"Elton Wang" <anonymous@discussions.microsoft.com> wrote
> in message
>>news:0e4001c5324a$f57ee530$a501280a@phx.gbl...
>>> Hi sara,
>>>
>>> Change
>>> Dim cm As New SqlCommand("select * from student where
>>> id=@num", cnn)
>>>
>>> to
>>>
>>> Dim cm As New SqlCommand("select * from student where
> id="
>>> & num.ToString, cnn)
>>>
>>> HTH
>>>
>>> Elton Wang
>>> elton_wang@hotmail.com
>>>
>>>>-----Original Message-----
>>>>Hello all,
>>>>plz , i have the following code , which take student id
>>> and
>>>>passowrd,then check the id if it is found ,check
> password
>>> if it is
>>>>tru, if the password and id are true,the student can log
>>> in the
>>>>system, if the password if false ,he can try 3 times,if
>>> the id is not
>>>>recognized,the terminal is locked for 5 minutes.
>>>>when i compiled the code, the error message appered on
>>> the
>>>>dr=cm.executereader
>>>>i didn't know what is the problem with sql command.
>>>>code
>>>>...............
>>>>public sub log(byval num as integer,byval pass as
> string)
>>>>Dim cnn As New
>>>>SqlConnection("server=
>>> (local);database=db1;Trusted_Connection=yes")
>>>>Dim cm As New SqlCommand("select * from student where
>>> id=@num", cnn)
>>>>Dim dr As SqlDataReader
>>>>cnn.Open()
>>>> dr = cm.ExecuteReader
>>>> dr.Read()
>>>> If dr("id") = num Then
>>>> If dr("pass") = pass Then
>>>> MsgBox("login")
>>>> Else
>>>> MsgBox("invalid password")
>>>> End If
>>>> Else
>>>> MsgBox("Id is not recognized")
>>>> End If
>>>> dr.Close()
>>>>end sub
>>>>......................
>>>>plz help me , i am student and this is course project
>>>>Thankx
>>>>sara
>>>>Posted at: http://www.groupsrv.com
>>>>
>>>> Posted Via Usenet.com Premium Usenet Newsgroup Services
>>>>--------------------------------------------------------
> --
>>>> ** SPEED ** RETENTION ** COMPLETION ** ANONYMITY **
>>>>--------------------------------------------------------
> --
>>>
>>>> http://www.usenet.com
>>>>.
>>>>
>>
>>
>>.
>>

Relevant Pages

  • Re: help me plz
    ... Use parameterized query instead of thinking that its an integer I can pass ... > SQL injection attack was the byval num as integer function argument. ... > passing in the username as a string instead of the ID. ... >> type int, ...
    (microsoft.public.dotnet.framework.adonet)
  • Re: SELECT * FROM table WHERE field = %string%
    ... these approaches will lead you into a SQL injection attack. ... >character in the ascii table, which is 34 for the double-quotes. ... you will probably need to enclose the string in single quotes ... Notwithstanding the fact that you are asking for a multi-part field, ...
    (microsoft.public.vb.database)
  • Re: SQL 2000 & ASP.NET/Visual Studio 2005
    ... This enables you to pass parameters to the db instead of using a ... method that may simply end up concatenating a string together. ... you can mitigate the use of a sql injection attack. ... VS2005 connecting to SQL 2K database? ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: read writte to file
    ... Note that cK is of type int and not char, ... to match the return type of getchar. ... A line is like a string, ... and a string is terminated by a '\0' character. ...
    (comp.lang.c)
  • Re: making sure only integer is input
    ... I have a number guessing game in which users try to guess a random number. ... input is required of type int. ... I know a string is not what we're after but in terms of error-handling; How can we prevent users from entering a string? ... {/* declare a buffer for holding the input line */ ...
    (comp.lang.c)