SQL injection via user-controlled input
ID |
vbnet.inject.sql_injection |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
VB.NET |
Description
User-controlled input flows into a SQL statement without parameterization, which may allow SQL injection. Use parameterized queries (SqlParameter / command.Parameters) instead of building SQL by string concatenation.
Rationale
User-controlled input flows into a SQL statement without parameterization, which may allow SQL injection. Use parameterized queries (SqlParameter / command.Parameters) instead of building SQL by string concatenation.
The following code illustrates a vulnerable pattern detected by this rule:
Public Sub QueryStringToSqlCommand(ByVal Request As HttpRequest)
Dim id As String = Request.QueryString("id")
' VULNERABLE: SQL injection via user-controlled input
Dim cmd As New SqlCommand("SELECT * FROM users WHERE id = " & id, conn)
cmd.ExecuteReader()
End SubRemediation
Follow secure coding practices and review the references below for detailed remediation guidance.