We Keep Coding

How to generate a SQL Command string that is safe from SQL Injection?

I have a situation where I have to take input from a user, create a SQL command and send that command to a service that will execute the SQL. The service ONLY allows for a SQL string -- not additional parameters; so I am forced to create the entire SQL statement on my end of things.
I do not have any kind of access to the database itself -- only a service that sits overtop of it.
I realize the following is NOT safe:
var sql = $"SELECT * FROM tablename WHERE name = '{incomingdata.searchName}'";
But if I generate SQL with parameters, would this be safe from SQL injection?
var sql = $#"
DECLARE #Name varchar(50);
SET #Name = '{incomingdata.searchName}';
SELECT * FROM tablename WHERE name = #Name";

This is not an ideal situation. I would try and look for a parametrized way to solve this problem failing that I would test the input and in ANY case where a test fails not allow the query at all and ask the user to re-enter.
Do the following tests:
Length of input is smaller than a max name size (25 characters?)
All input characters are in the alphabet
No reserved SQL words (easy to find with a google search)
If the input does not fail any of these tests you should be OK. DON'T try to sanitize the input -- this can be hard/impossible to do with international character sets.

Disclosure: My background is C++, Java and TypeScript/JavaScript, not C#
Would this be more appropriate:
SqlCommand sql = new SqlCommand("SELECT * FROM tablename WHERE name = #Name");
sql.Parameters.Add("#Name", SqlDbType.VarChar, 50).Value = incomingdata.searchName);
Sanitizing the user data before it gets to this stage, using a trusted package, might also be helpful.

The second example is better, but still not fully secure.
SQL injection attacks can still occur if the input data is maliciously crafted, regardless of whether the input data is directly embedded into the string or used as a parameter.
A more secure way to handle this situation is to use parameterized queries, which automatically escape any special characters in the input data and prevent SQL injection attacks.
Unfortunately, if the service you are using only accepts raw SQL strings and does not support parameters, your options are limited. In this case, it is recommended to validate and sanitize the input data before constructing the SQL string to minimize the risk of SQL injection.
To make the SQL statement safe from SQL injection, you can use parameterized queries. In .NET, you can use the SqlCommand.Parameters property to define parameters and their values. The following is an example:
using (SqlConnection connection = new SqlConnection(connectionString))
{
connection.Open();
string sql = "SELECT * FROM tablename WHERE name = #Name";
using (SqlCommand command = new SqlCommand(sql, connection))
{
command.Parameters.AddWithValue("#Name", incomingdata.searchName);
using (SqlDataReader reader = command.ExecuteReader())
{
// process the results
}
}
}
In this example, the value of incomingdata.searchName is passed as a separate parameter and not directly concatenated into the SQL string. This protects against SQL injection because the parameter value is automatically escaped and properly formatted by the .NET framework.

You are along the right lines. You never want to use a variable that can be changed. Instead, you need to use SQL parameters. You can add a SQL parameter like this:
command.Parameters.Add(new SqlParameter("#Name", "incomingdata.searchName"));
And then refer to it in your query like this:
SELECT *
FROM tablename
WHERE name = #Name";
Once this is done, when a user tries to change the value of a variable the query will return no results. It should be said that this way of doing it does result in the SQL property assuming the type of the C# variable. There are other ways of doing this if you want to specify the type of the property to be different from the variables type. This is a useful resource https://jonathancrozier.com/blog/preventing-sql-injection-in-c-sharp-applications

What is purpose of using OleDb Parameters? [duplicate]

This question already has answers here:
When should I use prepared statements?
(4 answers)
Closed 1 year ago.
I have code that inputs data into db using OLEDB. Let's say it looks like this
var commandText = $"INSERT into {tableName}
({columnName1}, {columnName2})
VALUES ({value1, value2});"
var command = new OleDbCommand(commandText, connection);
command.ExecuteNonQuery();
Suggestion is to use OLEDB parameters, something like this
var commandText = $"INSERT into {tableName}
([{columnName1}], [{columnName2}])
VALUES (?, ?);"
var command = new OleDbCommand(commandText, connection);
command.Parameters.Add(new OleDbParameter(columnName1, value1));
command.Parameters.Add(new OleDbParameter(columnName2, value2));
command.ExecuteNonQuery();
What are the benefits of using parameters here?
Does it really improve security if the values are validated before?

With this code, no amount of parameters can help you.
The fact that you're concatenating the table name and the columns names makes your query vulnerable to SQL Injection attacks, which is the primary (but not only) reason to use parameters.
The way SQL injection works is by replacing parts of the string sent to the database with sql code. Parameters prevent that from happening because the database treats them as placeholders for data, which means it will not run any sql code that was passed through them.
However, since your table name and column names are also c# variables, they can be replaced with SQL code that the database will try to run.
Suppose the following code:
var tableName = "table (Col1) VALUES (null);DROP TABLE table;--";
// declare and populate columnName1, columnName2 with whatever values you want here, even just nulls
var commandText = $"INSERT into {tableName}
([{columnName1}], [{columnName2}])
VALUES (?, ?);"
// run SQL command here
This will insert a single record into table, and then drop the table from the database.
For more information, read my blog post entitled Back to basics: SQL Injection

Actually, yes. We all make mistakes and the extra safety added by the parameter object is like a second set of eyes.
Also, if you always use the parameter object, you run less of a risk in introducing errors down the line.

Syntax Error In Insert Statement SQL C#

I'm having trouble with the df.ExecuteNonQuery(); claiming that the insert statement has SQL errors. I'm not sure why the other parts of the program is working with the Insert statement, but the student one just refuses to work.
Database: http://puu.sh/hoTCv/c1ccb77551.png
OleDbCommand df = new OleDbCommand("INSERT into Students(ID,Password,FirstName,LastName,Street,City,State,Zip,EMail,GPA)" + "VALUES (?,?,?,?,?,?,?,?,?,?)", db);
//creating parameters
df.Parameters.AddWithValue("#ID", iDText.Text);
df.Parameters.AddWithValue("#Password", PassText.Text);
df.Parameters.AddWithValue("#FirstName", fnText.Text);
df.Parameters.AddWithValue("#LastName", LnText.Text);
df.Parameters.AddWithValue("#Street", StreetText.Text);
df.Parameters.AddWithValue("#City", CityText.Text);
df.Parameters.AddWithValue("#State", StateText.Text);
df.Parameters.AddWithValue("#Zip", ZipText.Text);
df.Parameters.AddWithValue("#EMail", EmailText.Text);
df.Parameters.AddWithValue("#GPA", GPAText.Text);
df.ExecuteNonQuery();
db.Close();

Password is a reserved keyword in Microsoft OLE DB Provider. You need to use square brackets like [Password]. As a best practice, change your column name to non-reserved word.
Also don't use AddWithValue method. It may generate unexpected results. Use .Add() overloads to specify your OleDbType and your parameter size.
And would be better to use using statement to dispose your OleDbConnection and OleDbCommand automatically instead calling .Close() or .Dispose() methods manually.

Can this:
INSERT into Students(ID,Password ....
To this:
INSERT into Students(ID,[Password] ....

Password is a reserved keyword. Wrap your password like [Password]
Microsoft SQL Server uses reserved keywords for defining,
manipulating, and accessing databases. Reserved keywords are part of
the grammar of the Transact-SQL language that is used by SQL Server to
parse and understand Transact-SQL statements and batches. Although it
is syntactically possible to use SQL Server reserved keywords as
identifiers and object names in Transact-SQL scripts, you can do this
only by using delimited identifiers.

C# prevent SQL injection for create statement

Does it make sense to prevent sql injection for a create statement? How could I do this?
I wanted to use command parameters, but it doesn't seam to work:
Example:
var createSql = "CREATE TABLE #TableName (#Column1 ...)";
var command = new SqlCommand();
command.CommandText = createSql;
command.Parameters.AddWithValue("#TableName", "XYZ");
command.Parameters.AddWithValue("#Column1", "Col");
// somewhere else
command.Connection = connection;
command.ExecuteNonReader(); // --> exception: invalid syntax at #TableName
Edit: The Column and TableNames are generated depending on other data. Indirectly also on userinput, yes. The given create statement is incomplete. It is just an example.
My problem is, that it seems that the command parameters are not replaced.

You cannot use bind variables for table or column names.
So you'll have to construct that SQL statement using string concatenation and if necessary, manual quoting/escaping, and be very careful how you go about it.
Direct user input would be very dangerous, but if it is only indirectly, for example just choosing options for auto-generated names, you should be okay.

in this specific code there can't be sql injection because the user doesn't have a say in this.
sql injection are caused when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed
in your case the user doesn't input anything so there is no worry.
however, your create table query is invalid. you can read here on create statement.
you can't use the "..." in a create statement, and every column must have a type

How to protect user specified table name from SQL Injection in C#, using MySQL

As a reaction to MySqlParameter as TableName, it seems that MySQL's Connector/NET library doesn't support table names from user input in the following way:
MySqlCommand cmd = new MySqlCommand("SELECT * FROM #table");
cmd.Parameters.AddWithValue("#table",TableNameFromUserInput);
So I tried to find another way, but I couldn't find any libraries that did this for me.
When searching for how to do this manually, I couldn't found anything that didn't tell you to use "prepared statements" from some already defined library, no matter the language.
To my limited knowledge of SQL, I only think it's necessary to put backticks (`) around the user input and then check the input for backticks - but I wanted to be sure.
Question
How do you protect a user specified table name from SQL-Injection when the MySQL Connector doesn't support it?

Check if
TableNameFromUserInput
is an existing table, before executing the query.
That prevents other errors like "table doesnt exist" aswell.

you cannot add tableName (as well as columnName) as parameter in prepared statements because it only supports for a value. For your safety, add additional code to validate tableName, ex.
string tableName = "hello";
tableName = UDFunctionClean(tableName);
string query = String.Format("SELECT * FROM `{0}`", tableName);
MySqlCommand cmd = new MySqlCommand(query);