SQL injection attacks (SQL injection) in ASP. NET development practices)

Security Vulnerabilities at the data layer include SQL commands in input data strings. Poor Design ProgramCheck is ignored.

Main reasons
Use string connection to combine SQL commands
Accounts with excessive Permissions
Functions that are not necessary but with excessive power are enabled
Too much trust in the data entered by the user, no limit on the number of characters entered, and no potential command Check on the data entered by the user

Injection Principle
If the SQL command string is not replaced by a single quotation mark string, the string variable is maliciously tampered with when it is entered into the command string.

The role of SQL syntax.

Hazards
Use others' ID to log on to the system
Unauthorized access to the database
Malicious deletion/modification of databases/Data Tables/records
Modify or change the Operating System
Obtain Higher system Permissions
Damage Hard Disk Data

Defend against SQL injection attacks
Use parameterized Query
Replace input parameters with characters
Use other safer methods to connect to the SQL database, such as the database connection component that has fixed the SQL Injection problem. For example, the sqldatasource pair of ASP. NET

For example, or as a result
Use SQL anti-injection system.