Example of SQL Injection attack

November 26, 2014 0 Comments

SQL Injection means, Inject the database by the SQL Query, this query executed by the input control like TextBox, URL etc. Suppose we have a table department and we want to retrieve some data from the table by the TextBox. You want to retrieve all the rows, which is related to first department no. Now, you should to enter 1 in the TextBox, then you will get rows, which is related to putted number in the TextBox. If you want to put some number like:

1 or 1=1 then you will get all rows which is available in the table.
If this query is executed it means deletion is also possible with the table.Like
1;Drop table table_name

Source Code
<%@ Page Language="C#" AutoEventWireup="true" CodeFile="my.aspx.cs" Inherits="my" %>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<form id="form1" runat="server">

    Enter Department_No :
    <asp:TextBox ID="TextBox1" runat="server" Width="220px"></asp:TextBox>
    <br />
    <br />
    <asp:Button ID="Button1" runat="server" OnClick="Button1_Click" Text="Search Data" />
    <asp:GridView ID="GridView1" runat="server">


Code Behind

using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
using System.IO;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
public partial class my : System.Web.UI.Page
protected void Page_Load(object sender, EventArgs e)
protected void Button1_Click(object sender, EventArgs e)
    SqlConnection con = new SqlConnection();
    con.ConnectionString =ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();

    SqlCommand cmd = new SqlCommand();
    cmd.CommandText = "select * from [Department] where dept_no=" + TextBox1.Text;
    cmd.Connection = con;
    DataSet ds = new DataSet();
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    GridView1.DataSource = ds;

Now code Generate the following output

Bill Smithwick

Some say he’s half man half fish, others say he’s more of a seventy/thirty split. Either way he’s a fishy bastard. Google