Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

.NET libraries to sanitize input?

Are there any thoroughly tested .NET libraries out there to sanitize input from things like script/sql injection?

like image 423
TWA Avatar asked Jun 02 '09 12:06

TWA


3 Answers

SQL injection and Cross-Site Scripting (a.k.a. XSS or Script Injection) are different problems.

1) SQL Injection is very easy, always use parametrized queries (SQLParameter) and try really hard to NEVER do sp_exec @query within T-SQL stored procedures. .Net parametrized queries will not protect against this second order injection.

2) XSS is more difficult to universally mitigate since there are so many places that JavaScript can be inserted into HTML documents. The recommendations to use AntiXSS for encoding user data is right on. Use this library before inserting user data into output documents. Unfortunately, if you are using ASP.Net server controls encoding all data may lead to double-encoding and display artifacts. This happens because some control properties encode data while others don't. Refer to this table to find out the properties encoded by default. Use Anti-XSS before assigning to any properties that don't encode.

like image 50
Chris Clark Avatar answered Oct 20 '22 09:10

Chris Clark


I like to use the Microsoft AntiXSS library. It's free and pretty easy to use.

For SQL injection, I always use parameters. Again, they are easy to use and I don't like trying to escape special characters. It's a recipe for disaster if you ask me.

like image 41
Tim Scarborough Avatar answered Oct 20 '22 08:10

Tim Scarborough


Use parameterised commands, rather than trying to sanitize strings, to guard against SQL Injection.

like image 6
Mitch Wheat Avatar answered Oct 20 '22 10:10

Mitch Wheat