SharePoint Database Security - SQL Injection

Question

I have developed a custom web part for SharePoint and I am concerned about its security. The web part is essentially the basis of a quiz that starts with user registration; they simply enter their name and email address. For successful surveys, the result is written to the list, and these registration variables are placed directly on the list.

Should I be worried about SQL injection attacks? Is the data shielded by SharePoint before being added to the list? Or does SharePoint use named parameters with a prepared statement? Alternatively, does it just go verbatim?

Thank you for understanding.

UPDATE

I would perhaps rephrase that I am inserting code into a SharePoint list, so it will not be "directly" into the database. I'm not sure if a process is happening (especially in terms of security) when an item is inserted into a list and (I guess) into a database table somewhere. Here are some of the code I'm using:

Get user input through standard HTML input

output.Write("<div>Please enter your e-mail address</div><div><input type=\"text\" value=\"\" size=\"30\" name=\"takerEmail\"></div>"); 

Here's how data is inserted

  using (SPSite siteSuccessWrite = new SPSite("http://www.mycompany.com")) { using (SPWeb webSuccessWrite = siteSuccessWrite.OpenWeb()) { SPList insertResults = webSuccessWrite.Lists[resultsList]; SPListItem quizEntry = insertResults.Items.Add(); quizEntry["firstName"] = firstName; quizEntry["lastName"] = lastName; quizEntry["email"] = email; quizEntry["phone"] = phone; quizEntry["department"] = dept; quizEntry["score"] = score; quizEntry.Update(); } } 

Answer 1

When using the object model, you don’t have to worry about using SQL Injection as a Sharepoint for you (it uses built-in parameterized stored procedures).

You need to worry about XSS and the like, although when displaying the survey results to the user / judge, because unescaped HTML can easily invoke the SharePoint / Client Object Model web services model and do something in the context of the current user.

Answer 2

Do you write SQL yourself? If not, I would test it by doing some SQL injection attacks. Try entering data like John Smith' -- in the name field and see if quotes and dashes get into the database. If this is not the case (or you don’t have any data at all), there may be a SQL injection vulnerability. (Note that this is not an exhaustive test, so do not rely on it)

I would suggest that SharePoint contains protection against SQL injection, otherwise every second government and large corporate site will be executed. (Secondly, neglect that :)

For cross-site scripting attacks, try some of them: http://ha.ckers.org/xss.html