SQL Injection means, Inject the database by the SQL Query, this query executed by the input control like TextBox, URL etc. Suppose we have a table department and we want to retrieve some data from the table by the TextBox. You want to retrieve all the rows, which is related to first department no. Now, you should to enter 1 in the TextBox, then you will get rows, which is related to putted number in the TextBox. If you want to put some number like:
1 or 1=1 then you will get all rows which is available in the table.
If this query is executed it means deletion is also possible with the table.Like
1;Drop table table_name
Source Code
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="my.aspx.cs" Inherits="my" %>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
Enter Department_No :
<asp:TextBox ID="TextBox1" runat="server" Width="220px"></asp:TextBox>
<br />
<br />
<asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="Search Data" />
<asp:GridView ID="GridView1" runat="server">
</asp:GridView>
</form>
</body>
</html>
Code Behind
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
using System.IO;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
public partial class my : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button1_Click(object sender, EventArgs e)
{
SqlConnection con = new SqlConnection();
con.ConnectionString =ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();
con.Open();
SqlCommand cmd = new SqlCommand();
cmd.CommandText = "select * from [Department] where dept_no=" + TextBox1.Text;
cmd.Connection = con;
DataSet ds = new DataSet();
SqlDataAdapter da = new SqlDataAdapter(cmd);
da.Fill(ds);
GridView1.DataSource = ds;
GridView1.DataBind();
}
}
Now code Generate the following output
1 or 1=1 then you will get all rows which is available in the table.
If this query is executed it means deletion is also possible with the table.Like
1;Drop table table_name
Source Code
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="my.aspx.cs" Inherits="my" %>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body>
<form id="form1" runat="server">
Enter Department_No :
<asp:TextBox ID="TextBox1" runat="server" Width="220px"></asp:TextBox>
<br />
<br />
<asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="Search Data" />
<asp:GridView ID="GridView1" runat="server">
</asp:GridView>
</form>
</body>
</html>
Code Behind
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
using System.IO;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
public partial class my : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button1_Click(object sender, EventArgs e)
{
SqlConnection con = new SqlConnection();
con.ConnectionString =ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();
con.Open();
SqlCommand cmd = new SqlCommand();
cmd.CommandText = "select * from [Department] where dept_no=" + TextBox1.Text;
cmd.Connection = con;
DataSet ds = new DataSet();
SqlDataAdapter da = new SqlDataAdapter(cmd);
da.Fill(ds);
GridView1.DataSource = ds;
GridView1.DataBind();
}
}
Now code Generate the following output
