Sql injection prevention Part 6

sql injection vulnerability prevention
sql injection attack prevention

Text version of the video

Healthy diet is very important both for the body and mind. If you like Aarvi Kitchen recipes, please support by sharing, subscribing and liking our YouTube channel. Hope you can help.

Slides

All ADO .NET Text Articles

All ADO .NET Slides

All Dot Net and SQL Server Tutorials in English

All Dot Net and SQL Server Tutorials in Arabic

In this video we will learn about
1. Preventing sql injection using parametrized queries and stored procedures.
2. How to execute stored procedures and parameterized queries using ADO.NET command object

[parko]

For everyone out there who deliver tutorials on anything whatsoever, this is how you do it. Brilliant kudvenkat.

[dannyb]

I clicked the like button even before i watched the video. Another great post!

[Modern_revolution]

Great Venkat! Really you are doing superb Job by sharing all these valuable information.

[toothstepper]

you should have Udemy courses...you'd get a lot of students

[satyamswaraj]

I think their is slight mistake in this video, when he is putting the value in textbox, at starting he is using ‘- - i’ on which I think it should start without - -

[unlimitedRewind]

A parameter in SQL starts with @ Symbol, Thanks, just writing to remind my memory.

[sandeepcool]

Wonderful way of Teaching, Hates off Dear Venkat Sir

[AlexMartinez-berh]

Thanks a lot, this is very excellent. and easy to use command text or stored procedures.

[yahiabousba]

you are the best. i'm learning every day to much in your course. thaks a lot ;)

[debit]

You could take away the extra %, since you have on in .CS and in the sql server

[anannyasaxena]

Please Answer my Query:

When we have already given @Product name + '%' in the stored Procedure, then why do we need to give it with Parameter in the code behind? Please explain

[Ayubajbnabi]

Thank you very much for Sharing, loved it.

[ashutoshpareek]

My thinking after watching the video is that parameterized is the only way to solve the injection issue because even when you use the stored procedures we are passing the parameter to SP....
However good information...subscribed the channel

[mannamramakrishna]

How the user will know the table name for implement any SQL injection

[HarishD-rb]

Check on video Time : 7:54,
you have entered the input field with commented values before it, So the entire input gets commented.

[sptechnologies]

Hello sir! I fell like you are entering the wrong command in textbox feild. You are commented that line in SSMS query window. Time duration :7.11 . Here are directly coping the text(--i'; Delete from tbleProductInventory --) from query windows in SSMS and pasting it in textbox field. Actually you have to remove comment sign before pasting it in textbox feild. You have to pass like this ( i'; Delete from tbleProductInventory -- ) .

In storeprocudure, you passed the value correctly withou comment sing before.. time duration : 14.10

[karthickeyan]

Sir i have a small request how the end user will know the table name to hack the application or delete the table sir . Since if he know the table name only  he can delete all the record . Can you please let me know what else he can do without knowing the table name . Thanks and your video is so great i watch all series and learn a lot first i like to thank for your work No words to say thanks sir . thank you once again .

[Dotnetawy]

excuse me I have a question.
if I used parameterized sql command with stored procedure to avoid SQLI
can I use dynamic sql within the SP ? or still un secure?

[sandeepdetc]

not working for me my gridview is not populating for parameterised value 06:30

[adrianliu]

Would you please upload some vedios about the asp.net CMS development from scratch?