Has MVC.Net any system to prevent SQL injection attack or I should check it manually in my code?
3 Answers
This is independant of the frontend, means to prevent this depend on the language you use and the features of your database connection.
Normally you simply use stored procedures to circumvent injection attacks
See here for an example.
2 Comments
Siamak Ferdos
I have my own
ORM. My question is this that I should check injection at my ORM or MVC itself has some system like validation on razor or controller level that prevent injection? I use C# and Razor.
Marged
@SiamakFerdos You should state this in your question, because this makes a difference and has an influence on what people will answer. Perhaps it is also a good idea to ask two questions (does mvc offer such a feature / does razor offer such a feature) in your post or ask a new question with focus on razor. Perhaps this is of interest: troyhunt.com/2012/12/stored-procedures-and-orms-wont-save.html
Has MVC.Net any system to prevent SQL injection attack
No, because this is outside the scope of 'MVC'.
MVC deals with the front-end, while SQL injection attacks occur at the back-end. MVC does not know how you are persisting your data, eg Entity-Framework, nHibernate, ADO directly or your own ORM.
should I check in my own code
from the comments, this appears to mean: should I check in my own ORM.
Yes. Always. Regardless of what you are using as a front-end, your own ORM should check (or, more specifically, not allow by design) SQL injection attacks.
This leads to the question:
can MVC check for this
Yes - you can write a custom validator attribute to apply to your poco properties to check for some potential SQL injection attacks.
I say earlier, "not allow by design" because there is no way you will be able to check for 100% of all possible current and future SQL injection methods for all of the DB engines that your ORM handles.
You'll also need to consider that 'attacks' will be different per DB engine (Oracle, TSQL, nosql), so any UI check will need to be aware of the DB engine currently in use.
Comments
Has MVC.Net any system to prevent SQL injection attack?
No, it does not. MVC is completely unaware of SQL servers. It is not its area of responsibility.
I should check it manually in my code?
No. Absolutely not. If you rely on a string check to see if the user's input is intended to create an SQL injection, you will get it wrong. Even if you eventually get it right (at which point your validation code might get really long and complicated), all this effort will be in vain because you never needed to do it in the first place.
What you should do is always use parameters in your queries and never construct an SQL statement via string concatenation. If you are using a sane ORM framework, it will do that for you.
This advice does not change with or without the use of ASP.NET MVC.
Comments
ORM. My question is this that I should check injection at myORMorMVCitself has some system like validation onrazororcontrollerlevel that prevent injection?Sql Injectioncan be validate on view level. So May beMVC.Netthat created some validation for inputs, has something like validation for injections too. In myORMmain methods work withSPbut some of them create string query.