All geek questions in one place

Is there any security benefit when using a stored procedure to toggle a boolean value from a checkbox

I have a boolean variable stored in a SQL Server database. This is provided to end users as a check box on an ASP.NET web page. Toggling the checkbox naturally updates the value in the database.

I was going to delete the SQL query, which is written in text form in the C # code behind, and replace it with a stored procedure in order to increase security, protecting against SQL injection attacks. My understanding of injection attacks is limited, but, of course, it was impossible to trigger an attack from an unsecured flag entry? Or is it possible?

+3
source share
3 answers

Well, as a rule, you should always use stored procedures or parameterized sql. Can you do this by clicking the checkbox? In fact, it all depends on how the code is written. At first glance, I would say no, but there are many possibilities that can affect this.

Remember that the page, when it is hosted, sends essentially a text value to the server. Someone might send an sql injection attack instead of a checkbox value. Now asp.net does a good job of this, but that doesn’t mean that if the code is written to bypass asp.net checks, etc., that this cannot be.

, , , , : " ". , . .

+1

, , . , - . , SQL, , @parameters , .

.

.

+1

ASP.Net , , , . YourCheckBox., . , - , , , - - , , , , . , . , , .

, HTML-, , , . asp.net.

+1

Source: https://habr.com/ru/post/1756562/

More articles:


All Articles