| Author: Deepa 14 Jun 2008 | Member Level: Diamond Points : 0 |
Good...
|
| Author: Jessie 16 Jun 2008 | Member Level: Gold Points : 2 |
14th point expansion
====================
no=textbox1.text;
Dont write query as
sql= "select * from tab_name where no=" + no
Instead used Command parameters to assign value to query.
In the text box if some one enters like "1;delete from tablename;"
[provided the user knows tablename]
if we directly assign this to a query the table will be deleted. Instead if we assign it to a command parameter it will throw an error saying type mismatch and there by we can avoid sql injection.
|