New answers tagged .net
For SQL injection, you're basically on the right path. The best advice it to not roll your own. Use something well known; whichever language you're using probably has a library to be used with proper parametrised SQL. OWASP has a very good article including mitigations against this attack vector here If this string is never executable, then it's not a ...
...but I am looking for practical threats in such a scenario (C#) There are a huge number of ways that you could introduce a vulnerability by rolling your own login. A few that come to mind: User enumeration - I've seen people who give descriptive messages when a login fails ("user does not exist", "user exists, but password was incorrect", etc.) ...
I taught to never "roll your own" in situations where there is something already written to do something similar. If I were you I would try to find something thats proven to work and try to build around or on top of that.
The danger is expressed in Schneier's law: any person can invent a security system so clever that he or she can't imagine a way of breaking it. The only way anyone knows to test if any given system is secure is to have lots and lots of clever people try to break it over a long period of time. You won't have that with a system you rolled yourself.
Top 50 recent answers are included