Re: [RESOLVED] Me.txt & #
Re: [RESOLVED] Me.txt & #
SQL injection has nothing to do with a firewall. If this program is exposed to users outside your organization, you should most definitely NOT append textbox content directly into a query.
What would happen if somebody added something like this in your textbox:
"1 ; DROP TABLE <one of your table names here"
(I may have the syntax wrong on the statement separator, but you get the idea).
That would just be malicious. Here's a comic on it:
http://xkcd.com/327/
There are much nastier exploits than that one, though.
Re: [RESOLVED] Me.txt & #
well i check the contents of the textbox with an 'isInteger' private function.
I've never worried about security before, so I hope you don't mind my asking a few more questions:
The sql server is hosted on the company's intranet, which is very, very secure. We tightly control permissions to these tables, and anyone trusted with access wouldn't insert anything malicious (and if they did, we'd find them out). If someone could hack into our intranet somehow, they'd have a much easier time not using sql injections and simply opening sql enterprise to lift data off our server, right?
Re: [RESOLVED] Me.txt & #
If you are validating the contents of the textboxes to confirm that they are integers, and you are not doing this using something like Val, but are using something like Integer.TryParse, then you are all set. The difference between the two is that Val would confirm that at least part the first part of the string can be turned into an integer, regardless of the rest, while Integer.TryParse will only return true if the WHOLE string can be converted into an integer. Therefore, Val will allow a malicious trailer, while TryParse will not.
If the program is ONLY running internally, and only by trusted individuals, then I wouldn't worry about it. After all, if a trusted individual proved to be unworthy of that trust, they would likely be able to do FAR worse than a SQL injection. The real danger is from outward facing forms, and it sounds like you don't have that issue.
And, yes, if somebody hacks into your network, you have much worse problems than SQL injection.
Still, the other point I made is worth a thought. What you are doing to update records from textboxes is reminiscent of how I would have done things under VB6. There is a real reason to stick with existing code (it works), but you should be aware that there are other alternatives available now that may well prove to be better.