I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET Configuration.
I have this code when the user press the login button.
SqlConnection con = new SqlConnection();
con.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
SqlCommand com = new SqlCommand();
con.Open();
com.Connection = con;
com.CommandText = "SELECT * FROM [Users-Users] WHERE (Password=@Password) AND (Username=@Username) ";
com.Parameters.AddWithValue("Password", System.Web.HttpUtility.HtmlEncode(PasswordTextBox.Text));
com.Parameters.AddWithValue("Username", System.Web.HttpUtility.HtmlEncode(UsernameTextBox.Text));
SqlDataReader data = com.ExecuteReader();
if (data.Read())
{
//Logged in successfully here I have redirect options
}
You can see that I have HTML encoding here that can do these:
& → & (ampersand, U+0026)
< → < (less-than sign, U+003C)
> → > (greater-than sign, U+003E)
" → " (quotation mark, U+0022)
' → ' (apostrophe, U+0027)
So can we login without password using Sql Injection? e.g→
username textbox :admin
password textbox :pass" OR 1=1
admin
as username andpass" OR 1=1
as password. But isn't any way to use Sql Injection here. I had some hack problems in last week that I know that its because of Sql Injection.