SQL injection attack on asp registration form pages?

Question

I need to know the process of the SQL injection attack on registration form made by asp or asp.net ? this is a crucial question to me. thank you

Answer 1

See How to avoid SQL Injection in ASP.net application

Answer 2

Always validate the SQL query, remove any unwanted characters and use SQL Parameters to avoid SQL Injection.

Answer 3

here is a simple example:

screen input:

enter your name:  Bill'); delete from users --

build query

insert into users (name) values ('''+@Name+''')'

actual query:

insert into users (name) values ('Bill'); delete from users --')

what happens: all your users get deleted

FYI, not sure of the database you're using, but @Name is a variable, and "--" is a comment

Answer 4

Use stored procedures to avoid SQL injection, also use Server.HtmlEncode(string input)