We’re rewarding the question askers & reputations are being recalculated! Read more.
    Tweeted twitter.com/#!/StackSecurity/status/456391970747719680
3 deleted 111 characters in body
source | link

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as theThe parameters are passed to the function ExecuteDataSet() unvalidated, this should lead to an SQLi vulnerability.  

Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as the parameters are passed to the function ExecuteDataSet() unvalidated, this should lead to an SQLi vulnerability.  

Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

The parameters are passed to the function ExecuteDataSet() unvalidated.

Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.

2 added 275 characters in body
source | link

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as the parameters are passed to the function ExecuteDataSet() unvalidatedunvalidated, this should lead to an SQLi vulnerability.

My question is doesDoes the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi.? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures. Any help

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is appreciatedabout the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.  

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as the parameters are passed to the function ExecuteDataSet() unvalidated, this should lead to an SQLi vulnerability.

My question is does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi. I am unable to find any examples on the Internet which use the same method to implement Stored Procedures. Any help is appreciated.

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as the parameters are passed to the function ExecuteDataSet() unvalidated, this should lead to an SQLi vulnerability.

Does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi? I am unable to find any examples on the Internet which use the same method to implement Stored Procedures.

I have had a look at the secure implementation of stored procedures in VB which clearly uses parameterized query. My question is about the method ExecuteDataSet being safe/unsafe for passing parameters to stored procedures.  

1
source | link

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet

 Result = DBInstance.ExecuteDataSet(Name, paramArrayList.ToArray)

Here, 'Name' is the name of the stored procedure and the input parameters from the client are passed in an array. 'DBInstance' is obtained from DatabaseProviderFactory which comes from Microsoft.Practices.EnterpriseLibrary.Data. The stored procedure uses the parameters in the query as shown below:

CREATE procedure sp_name
(
    @para1      VARCHAR(25),
    @para2      VARCHAR(25)

)       
as  
SELECT x,y FROM mytable
WHERE p = @para1 AND q = @para2 

go

As far as I understand, this is direct string concatenation and as the parameters are passed to the function ExecuteDataSet() unvalidated, this should lead to an SQLi vulnerability.

My question is does the method ExecuteDataSet perform any kind of validation on the data passed to it in order to prevent SQLi. I am unable to find any examples on the Internet which use the same method to implement Stored Procedures. Any help is appreciated.