Prevent ASP. NET from being attacked by SQL Injection

It is not difficult to prevent ASP. NET from being attacked by SQL injection. you only need to filter all input content before using the content entered in the form to construct an SQL command. You can filter the input content in multiple ways.

First, the following technologies can be used to dynamically construct SQL queries.

Replace the single quotation marks (single quotation marks), that is, change all single quotation marks to two single quotation marks to prevent attackers from modifying the meaning of SQL commands. delete all the hyphens in user input content. For database accounts used to perform queries, restrict its permissions.

Second, use the stored procedure to execute all the queries.

The SQL parameter transmission method prevents attacks by using single quotes and hyphens. In addition, it allows database permissions to be restricted to only allowing specific stored procedures to be executed. All user input must comply with the security context of the called stored procedure, in this way, it is difficult to launch injection attacks again.

Third, restrict the length of form or query string input.

If a user's login name can contain a maximum of 10 characters, do not recognize the 10 or more characters entered in the form. This will greatly increase the number of characters inserted by attackers in SQL commands.
HarmfulCode.