Click here to Skip to main content
15,888,733 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have the below code. Before doing the
dataAdapter.Update(dataset, " TableX ");
I add some rows to the datatable which have some columns nvarchar. Does this prone to Sql Injection
ds.tables[0].Rows["TableX"] = MALICIOUS SQL INJECTION ATTEMPT; // let's
say this is where the end user could slip malicious string he wanted
into


What I have tried:

using (var dataAdapter = new SqlDataAdapter(selectCommand))
using (var cmdBuilder = new SqlCommandBuilder(dataAdapter))
{
cmdBuilder.ConflictOption = ConflictOption.OverwriteChanges;

using (var dataset = new DataSet())
{
var stopwatch = new Stopwatch();

dataAdapter.UpdateBatchSize = 0;
dataAdapter.AcceptChangesDuringFill = false;
dataAdapter.AcceptChangesDuringUpdate = false;

stopwatch.Start();
dataAdapter.Fill(dataset, "TableX");
newrow contains some columns of type navrchar
ds.Tables["TableX"].Rows.Add(newRow);
dataset.AcceptChanges();

dataAdapter.Update(dataset, " TableX ");
}
}
Posted
Updated 31-Mar-16 1:54am
v2

1 solution

No. SQL Injection only happens when the command itself is "editable" by the user: i.e. when you concatenate strings to form the SQL command.
Provided your SELECT command contains no user input, you should be fine, as the CommandBuilder always uses parameterized queries when generating it's SELECT / UPDATE / INSERT commands. The values you send via the parameters are never parsed by SQL, so injection can't occur.
 
Share this answer
 
Comments
OriginalGriff 31-Mar-16 12:35pm    
An example of what?
You already have DataAdapter code...and you can't *want* and example of SQL Injection! :laugh:
MYQueries1 31-Mar-16 13:18pm    
I want how CommandBuilder preapres the update commands internally
OriginalGriff 31-Mar-16 14:00pm    
Then it's time for some reading! :laugh:

http://referencesource.microsoft.com/

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900