There are 5 misunderstandings:
1, SQL injection is more difficult to prevent, you need to replace select,delete, such as a typing character
In fact, no more than the replacement of character type single quotes for two single quotes good! There is no use for any number of replacements, so be sure to type conversions.
2, ignore the things that DropDownList came
In fact, all the client's things are not trustworthy, select the dropdown box is also! Because you can make an HTM submission to the server yourself.
3. Access is less secure than SQL Server
Security unsafe key See how to use, if SQL Server is still used like access, a sa account, it is clear that SQL Server is less secure than access, you can get the table name and field name directly! Access turns out to be safe, because it can only be obtained by a bitwise guess.
4, the website does not display the error message to explain the website is safe
When there are records to show the record, there is no record when the display can not find any records, through these two states will be able to guess the name of the field, so the Web page error can not be explained is safe
5. Ignore Post submitted information
A lot of people on the URL to pass on the things that are strictly filtered, for post things to ignore is wrong, post things more easily injected, because the general field more
In ASP.net, it is strongly recommended that you implement SQL instead of SQL concatenation by using parameters, because even if you filter each of the hundred difficult to have sparse
Like what:
SqlConnection conn=new SqlConnection (system.configuration.configurationsettings.appsettings["Conn"));
SqlCommand comm=new SqlCommand ("Update tb1 set vname= @vName, iage= @iAge where id= @id", conn);
SqlParameter parm1=new SqlParameter ("@vName", sqldbtype.nvarchar,50);
Parm1. Value= ((TextBox) E.item.findcontrol ("name")). Text;
SqlParameter parm2=new SqlParameter ("@iAge", SqlDbType.Int);
Parm2. Value= ((TextBox) E.item.findcontrol ("Age")). Text;
SqlParameter parm3=new SqlParameter ("@id", SqlDbType.Int);
Parm3. Value=this. Datagrid1.datakeys[e.item.itemindex];
Comm. Parameters.Add (PARM1);
Comm. Parameters.Add (PARM2);
Comm. Parameters.Add (PARM3);
Conn. Open ();
Comm. ExecuteNonQuery ();
Conn. Close ();
So the code looks comfortable and safe, he le?
