ASP.NET SQL Injection

Question

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET Configuration.

---

I have this code when the user press the login button.

    SqlConnection con = new SqlConnection();
    con.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
    SqlCommand com = new SqlCommand();
    con.Open();
    com.Connection = con;
    com.CommandText = "SELECT * FROM [Users-Users] WHERE (Password=@Password) AND (Username=@Username) ";
    com.Parameters.AddWithValue("Password", System.Web.HttpUtility.HtmlEncode(PasswordTextBox.Text));
    com.Parameters.AddWithValue("Username", System.Web.HttpUtility.HtmlEncode(UsernameTextBox.Text));
    SqlDataReader data = com.ExecuteReader();
    if (data.Read())
    {
        //Logged in successfully here I have redirect options
    }

You can see that I have HTML encoding here that can do these:

    &  → & (ampersand, U+0026)
    &lt;   → < (less-than sign, U+003C)
    &gt;   → > (greater-than sign, U+003E)
    &quot; → " (quotation mark, U+0022)
    &apos; → ' (apostrophe, U+0027)

So can we login without password using Sql Injection? e.g→

username textbox :admin
password textbox :pass" OR 1=1

Answer 1

You are using parameterised queries consistently for all variable values, so there is no SQL injection attack.

However, storing database values in HTML-encoded format is an antipattern. You'll make it difficult to process the data at an SQL level (since 1 db character no longer equals one on-page character), you'll produce inappropriately-encoded output for non-HTML formats (eg sending mail), and you'll fail to properly HTML-encode any data that comes into the database by other means (or which doesn't touch the database at all, eg a Parameter output straight onto the page).

The time to HTML-encode is when you are dropping some text into an HTML page. In ASP.NET templates you get the <%: ... %> tag to do this automatically, as well as attributes of WebForms doing the right thing (caution: not always). HTML-encoding should not be done as an input-processing or database-query-creation step because those places aren't anything to do with HTML.

Also you should of course be storing passwords using a salted hash (ideally a strong one like bcrypt) and not in the clear as implied by the Password=@Password comparison.

Answer 2

When accessing a content provider, use parameterized query methods such as query(), update(), and delete() to avoid potential SQL injection from untrusted sources. Note that using parameterized methods is not sufficient if the selection argument is built by concatenating user data prior to submitting it to the method. (Android Security Tips)

To prevent SQL injection:

All queries should be parametrized.
All dynamic data should be explicitly bound to parametrized queries.
String concatenation should never be used to create dynamic SQL. 

by using parametrized statements the database is able to distinguish between what is meant to be data and what is meant to be a command, so even if an attacker inserts a malicious input this input will be treated as data and not interpreted as a command.