How to Prevent Sql Server Injection attacks? Using Entity Framework

Question

Hi team,   I Would like to ask one queation like How to Prevent SQL injection attacks which is using enity framework code    not in ADO.Net, i need a help and give me any suggisions.   Thanks,

Sachin Singh · Answer

at first what do you mean by sql injection attack?

if you are giving option to users to enter something like a form then they can enter a sql statements in it instead of what has been asked for, now in your code if you are constructing commands by concating user inputs then it is vulnerable to sql injection attack.

But with entity framework this is not the case , T-Sql are prepared by Linq providers like Linq to Entities in your case , then there is no chance of sql injection atleast though there is a chance of DOS attack means denial of service which you can prevent by using cloudflare.

however you should avoid IQueryable because it uses expression tree for extending the query where sql can be entered like a in a where statement.

so the simple answer is don't filter based on a string sql statements instead simply use lamda expressions and you are safe enough.

Sachin Singh · Answer

@Pratap you are saying that you are using Entity Framework but the code you have posted is pure Ado.Net code please go the link https://www.sharpencode.com/article/ADONET/sql-injection-attack   here i have explained in great detail about sql injection attack and it's prevention.

Rijwan Ansari · Answer

By default entityframework use parameterized query which prevent from sql injection. However, if you execute query then takecare with parameterized query.   Regards Rijwan

Prathap G · Answer

Hi Sachin, please find the below code public  async Task  Register(RegisterViewModel model)   {   if  (ModelState.IsValid)   {   var user =  new  ApplicationUser { UserName = model.Email, Email = model.Email };   var result = await UserManager.CreateAsync(user, model.Password);   if  (result.Succeeded)   {   await SignInManager.SignInAsync(user, isPersistent: false , rememberBrowser: false );   // For more information on how to enable account confirmation and password reset please visit https://go.microsoft.com/fwlink/?LinkID=320771    // Send an email with this link    // string code = await UserManager.GenerateEmailConfirmationTokenAsync(user.Id);    // var callbackUrl = Url.Action("ConfirmEmail", "Account", new { userId = user.Id, code = code }, protocol: Request.Url.Scheme);    // await UserManager.SendEmailAsync(user.Id, "Confirm your account", "Please confirm your account by clicking  here ");    return  RedirectToAction( "Index" ,  "Home" );   }   AddErrors(result);   }   I generated this code using the asp.net web and individual authentication for this I want to do SQL injection, while doing the registration, for that registration, I want to do SQL injection, so how can I add for this this code is generated using an entity framework, please give suggestions.

Sachin Singh · Answer

as long as you use parameterized query or stored procedure with ado.net, you are preventing any sql attack.

Prathap G · Answer

Sachin,   We can use ADO.Net in this code is this posibility to do prevent Sql server injection   Please give me the suggisions.

Sachin Singh · Answer

No, DbContext is the only bridge between your database and domain entity , it is actually unit of work which holds all debsets as generic repositories and track the changes in any dbset at last it commits only the changes to database when you call SaveChanges(). So , without dbcontext , you can't interact with database , otherways are to use plain Ado.Net which i will not recommend.

Sachin Singh · Answer

@pratap please learn different ways of creating domain models using entity framework https://www.sharpencode.com/article/EntityFramework/the-three-approaches-of-ef

Sachin Singh · Answer

in select statement why are uing so many parameters just use id that's it. ctx.Database.ExecuteSqlCommand(@ "SELECT * FROM[SonarSchema].[AspNetUsers] where Id=@Id and Name=@Name" ,  new  object[]{model.Id,model.Name});
if it is an update statement then let me know

Salman Beg · Answer

Hi Pratap. Can you share some code that in which line you are getting sql injection in entity framework. Thanks.