Develop Reference

Random special characters in insert

I have the following Code in C# ( Sql server (LocalDB)\v11.0)
If Definition property has no special character , the Insert executed. but
some times it has an unknown special character in it , and i recive the Error.
for()
{
if(){
DB.Docommand("INSERT INTO Test5(P_Def) VALUES('"+ pro.Definition + "')");
}
}
in database the data type is nvarchar(Max)
but i receive the following error:
incorrect syntax near .....
I want to insert my property with special characters.
What can id do?
Thanks

Parameterize your insert. In addition to gaining an ability to insert strings with any characters that are valid inside nvarchar, you will also fix a major security problem by avoiding a potential sql injection attack:
var cmd = new SqlCommand("INSERT INTO Test5(P_Def) VALUES(#Def)", con);
cmd.Parameters.AddWithValue("#Def", pro.Definition);

SQL injection single quote Vulnerability

Hello I'm security testing a website I'm working on. Some developer tried to avoid SQL injection by replacing every single quote with double quotes. This is the C# code:
string sql =
#"SELECT *
FROM users
WHERE us_username = '$us'
AND us_password = '$pw'";
sql.Replace("$pw", txtPassword.Text.Replace("'","''"));
Is there any way that I can perform a SQL injection attack? I've tried the Unicode trick but it didn't work. The database runs on SQL Server 2008R2.

You should use parameterized command instead. Using string.Replace is just a bad idea.
var command = conn.CreateCommand();
command.CommandText = #"SELECT *
FROM users
WHERE us_username = #user
AND us_password = #password";
cmd.Parameters.Add("#user", txtUser.Text);
cmd.Parameters.Add("#password", txtPassword.Text);
This might be a potential candidate for your setup :
As an example, note the following trivial Stored Procedure:
create procedure GetData ( #param varchar(20) ) as
begin
declare #s varchar(200)
select #s = 'select * from dataTable where name = ''' + #param + ''''
exec (#s)
end
This SP may be called from a Web page, which executes validation code
before passing the input to the SP. At a minimum, this validation code
either verifies that the input does not contain a quote, or sanitizes
it to double any existing quote. For instance, the validation code may
be using string.Contains(), string.Replace(), Regular expressions,
etc. It is also possible that this Web page is behind a finely-tuned
Web Application Firewall that validates all input and verifies that no
quotes are included. A malicious user or attacker can submit malicious
code containing a modifier letter apostrophe (U+02BC, URL encoded to
%CA%BC). This will easily pass applicative validation code and WAF
filters, since these search for an actual quote (U+0027) which does
not exist in the input at this time. Obviously, IDS/IPS systems would
also not detect anything amiss. The validation mechanisms may even
search for various encodings of a quote, such as URL Encoding, UTF-8
encoding, Hex encoding, double encoding, and more – however, U+02BC is
none of these, and is in fact a completely different character value.
And this is where the interesting (or scary) part starts – the Unicode
homoglyph translation is not limited to base alphabet characters...
Specifically, the Unicode character U+02BC (modifier letter
apostrophe) can be translated by the database server to a simple quote
– ' (U+0027). There are, of course, many other similar examples.
Source : http://web.archive.org/web/20130401091931/http://www.comsecglobal.com/FrameWork/Upload/SQL_Smuggling.pdf

The code for that partical query is safe from SQL injection, but only when used with a certain databases. Each system has its own set of characters that needs escaping, so if you use that with for example MySQL then it's not safe. Other queries might not be safe.
The code should be replaced nevertheless as it is broken. As you need to fix the code you should also change it to using parameterised queries, which is a more robust and portable solution.
So, let's see what's broken. As the code is replacing one parameter at a time, they may interfer with each other. If I for example enter the user name has$$$pwnd and the password 1234 (yeah, weak password), you end up with a query that looks like:
SELECT *
FROM users
WHERE us_username = 'has$$1234nd'
AND us_password = '1234'
If some values contain the codes that is used for parameters replaced after it, the values become broken.
This could even be used to make an SQL injection in other queries in the code, if there are parameters of different types and the values are not properly verified. As values from one parameter can end up in another parameter, a string value could end up in a numeric parameter which doesn't have apostrophes around it, thus there is no need to sneak in an apostrophe to break out of a string literal to put harmful code in the query.

The best way to counter SQL Injection is to add parameters.
SqlCommand sql = new SqlCommand (#"SELECT *
FROM users
WHERE us_username = #user
AND us_password = #password")
sql.Parameters.Add("#users", SqlDbType.Varchar2, 5).Value = "users";
sql.Parameters.Add("#user", SqlDbType.Varchar2, 6).Value = "your_value";
sql.Parameters.Add("#password", SqlDbType.Varchar2, 8).Value = "your_value";
As you can see, you can do quite a bit to ensure what is being executed are the values that you want to only get executed.
What the developer has coded will only alter the sql statement after the fact, which is good if they are logging this sql statement. What you have now however will not protect against Sql Injection.

How to change symbol in string using c#

My C# application is able store the data into a SQL Server database. Currently I have to problem when user insert symbol ' in their string/sentences:
Example: I want to 'test' your system
So, when inserting into db the ' symbol will return an error while inserting by using sql query.
My query example :
INSERT INTO TABLE_NAME (POST_BODY)
VALUES ('i want to 'test' your system')
and then my plan here is to change that check the string if contains that ' symbol it will change to " symbol.
I have try using this code, but cannot:
void ChangeSymbol(String str)
{
Console.WriteLine("\"{0}\"", str);
Console.WriteLine("\"{0}\"", str.Replace(''', '"'));
}
Please anybody help to give some idea to face this problem. Thanks in advance.

There is no problem inserting a single quote into a database using SQL code. If you want to insert a text literal then you simply escape the single quote with another single quote, e.g.
INSERT INTO MyTable (GivenName, FamilyName) VALUES ('James', 'O''Connell')
If you're inserting a separate value into a SQL statement then you should be using parameters no matter the data type, so an issue with single quotes never arises, e.g.
mySqlCommand.CommandText = "INSERT INTO MyTable (GivenName, FamilyName) VALUES (#GivenName, #FamilyName)";
mySqlCommand.Parameters.AddWithValue("#GivenName", givenName);
mySqlCommand.Parameters.AddWithValue("#FamilyName", familyName);

Use parameter binding. I don't have a sample code to put in since we dont use MSSQL
here's a sample
http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.parameters(v=vs.110).aspx

You escape single quotes by doubling them. So try this:
string example = "I want to ''test'' your system";

A simple SQL problem: Making an SQL insert statement with text string that contain ' characters

I follow the syntax of
INSERT INTO Table1
VALUES (value1, value2, value3…)
This has worked fine so far. But now I have some values that contain normal English text like "I'm going home". The ' character ruins the SQL command in C#. I have written the following:
command.CommandText = "INSERT INTO Bio VALUES ('" + name + "','"I'm going home" + "');
evaluates to
INSERT INTO Bio VALUES ('Peter','I'm going home')
which obviously will not work. How do I make sure special character will not ruin the SQL statements?

Use SqlParameter for heaven's sake. Otherwise your program will be vulnerable to SQL Injection. It will also solve your problem with the special characters.

Learn about parameterized queries for your provider. They exists for Odbc, OleDb, Sql, etc.
command.CommandText = "INSERT INTO Bio Values (#name, #text)";
command.Parameters.Add(/* appropriate param type for your provider */); // add for #name, #text, etc.
// execute query

Use two single quotes whenever there is a single quote you want to escape
Also instead of building your queries like this, you should use parameterized queries in a language of your choice. Escaping the characters yourself opens the door for SQL Injections.

Usually you can escape a single quote by screening with another one.
For example the following is a valid statement
INSERT INTO myTable (Column1) VALUES ('Hello I''m Jack');
However I suggest you using parameters.
command.CommandText = "INSERT INTO Bio VALUES (#Name, #OtherValue)";
command.Parameters.AddWithValue("Name", name);
command.Parameters.AddWithValue("OtherValue", "I'm going home");
One addition point in favor of using parameters is that you are free from burden of formatting and other stuff. I mean date values, uniqueidentifiers, etc.

I do use
HttpUtility.HtmlEncode(text)
It makes all that SQL injection stuff disappear, and it seems easier than to use parameters.
Don't forget to use
HttpUtility.HtmlDecode(text)
to get your input back in the form you received it

How to escape simple SQL queries in C# for SqlServer

I use an API that expects a SQL string. I take a user input, escape it and pass it along to the API. The user input is quite simple. It asks for column values. Like so:
string name = userInput.Value;
Then I construct a SQL query:
string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
name.replace("'", "''"));
Is this safe enough? If it isn't, is there a simple library function that make column values safe:
string sql = string.Format("SELECT * FROM SOME_TABLE WHERE Name = '{0}'",
SqlSafeColumnValue(name));
The API uses SQLServer as the database.

Since using SqlParameter is not an option, just replace ' with '' (that's two single quotes, not one double quote) in the string literals. That's it.
To would-be downvoters: re-read the first line of the question. "Use parameters" was my gut reaction also.
EDIT: yes, I know about SQL injection attacks. If you think this quoting is vulnerable to those, please provide a working counterexample. I think it's not.

I was using dynamic sql (I can hear the firing squad loading their rifles) for search functionality, but it would break whenever a user searched for somebody with a surname like "O'Reilly".
I managed to figure out a work-around (read "hack"):
Created a scalar-valued function in sql that replaced a single quote with two single quotes, effectively escaping the offending single quote, so
"...Surname LIKE '%O'Reilly%' AND..."
becomes
"...Surname LIKE '%O''Reilly%' AND..."
This function gets invoked from within sql whenever I suspect fields could contain a single quote character ie: firstname, lastname.
CREATE FUNCTION [dbo].[fnEscapeSingleQuote]
(#StringToCheck NVARCHAR(MAX))
RETURNS NVARCHAR(MAX)
AS
BEGIN
DECLARE #Result NVARCHAR(MAX)
SELECT #Result = REPLACE(#StringToCheck, CHAR(39), CHAR(39) + CHAR(39))
RETURN #Result
END
Not very elegant or efficient, but it works when you're in a pinch.

One may wish to replace ' with '' instead of parameterizing when needing to address the ' problem in a large amount of ad hoc sql in a short time with minimal risk of breakage and minimal testing.

SqlCommand and Entity Framework use exec sp_executesql....
So there really is an alternative to raw strings with your own escaping pattern presumably. With SqlCommand you are technically using parameterised queries but you're bypassing the ADO.Net abstraction of the underlying SQL code.
So while your code doesn't prevent SQL Injection, the ultimate answer is sp_executesql not SqlCommand.
Having said that, I'm sure there are special handling requirements for generating an SQL Injection-proof string which utilizes sp_executesql.
see: How to return values from a dynamic SQL Stored Procedure to the Entity Framework?

Simple:
const string sql = "SELECT * FROM SOME_TABLE WHERE Name = #name";
and add the #name parameter with value:
cmd.CommandText = sql;
cmd.Parameters.AddWithValue("#name", name);

If you need to escape a string for a MSSQL query try this:
System.Security.SecurityElement.Escape(Value)