Click here to Skip to main content
15,908,172 members
Please Sign up or sign in to vote.
3.00/5 (1 vote)
See more:
I am trying to prevent some basic sql injections to occur. I can't seem to prevent a textbox from having the single quote or double quotation marks inserted into it. How would I do this ?
Posted

Dear Friend,

Here you have to suppress the user on key press event for not entering the character that can lead to SQL injection error for this you have to follow the following steps:-

1).
private void txtCompanyPhone_KeyPress(object sender, KeyPressEventArgs e)
{
    objCommonMethods.isNumericWithHyphen(e);
}


2).
     internal void isNumericWithHyphen(KeyPressEventArgs e)
     {
       int asciiValue = Convert.ToInt32(e.KeyChar);
       if ((asciiValue >= 48 && asciiValue <= 57) || asciiValue==45 ||         asciiValue==127 || asciiValue==8)
          return;
    else
        e.Handled = true;
}


Here i have given you the example of allowing only numbers in the textbox and restricting rest other characters. You just need to modify accordingly the same method by using the ascii value of the characters you want to restrict and which to allow.

I hope this will help you out. Please don't forget to mark this as your answer if it really helps you out.

Thanks
 
Share this answer
 
Don't bother.
It is more trouble than it is worth - you need to ban quotes, double quotes and (preferably) semicolon as well, but in pasted text as well as typed. You can do it in the TextBox.TextChanged event, but you are much, much better off using parametrized queries instead.

If you never concatenate strings, it doesn't matter what they type - and there are good reasons why quotes should be allowed - they are part of some names for example.
 
Share this answer
 
Comments
Orcun Iyigun 23-Feb-12 12:38pm    
5ed.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900