Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert SQL injection vulnarable code to use parameters instead #19

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

tfsjohan
Copy link
Owner

This pull request includes changes to the Repository class in the Api/Data/Repository.cs file to improve the way SQL queries are constructed and executed. The changes replace the use of string interpolation to construct SQL queries with parameterized queries, which improves the security of the application by mitigating SQL injection attacks.

The most important changes are:

  • public class Repository(IConfiguration configuration) : IRepository method: Replaced the SQL query string with a parameterized query and added parameters for id using command.Parameters.AddWithValue("@id", id).

  • public Person GetAdministrator() method: Similar changes as above, replaced the SQL query string with a parameterized query and added parameters for id.

  • public Person AddPerson(Person person) method: The SQL query string to insert a new person into the database was replaced with a parameterized query. Parameters for id, name, age, and description were added.

  • public void UpdatePerson(Person person) method: The SQL query string to update a person in the database was replaced with a parameterized query. Parameters for id, name, age, and description were added.

These changes not only enhance the security of the application but also improve the readability and maintainability of the code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant