Convert SQL injection vulnarable code to use parameters instead #19
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request includes changes to the
Repository
class in theApi/Data/Repository.cs
file to improve the way SQL queries are constructed and executed. The changes replace the use of string interpolation to construct SQL queries with parameterized queries, which improves the security of the application by mitigating SQL injection attacks.The most important changes are:
public class Repository(IConfiguration configuration) : IRepository
method: Replaced the SQL query string with a parameterized query and added parameters forid
usingcommand.Parameters.AddWithValue("@id", id)
.public Person GetAdministrator()
method: Similar changes as above, replaced the SQL query string with a parameterized query and added parameters forid
.public Person AddPerson(Person person)
method: The SQL query string to insert a new person into the database was replaced with a parameterized query. Parameters forid
,name
,age
, anddescription
were added.public void UpdatePerson(Person person)
method: The SQL query string to update a person in the database was replaced with a parameterized query. Parameters forid
,name
,age
, anddescription
were added.These changes not only enhance the security of the application but also improve the readability and maintainability of the code.