What is SQL Injection in C# and how can I prevent it?

What is SQL Injection in C# and how can I prevent it?

SQL Injection is a code injection technique that exploits vulnerabilities in an application's software by manipulating SQL queries. In C#, it often occurs when user input is directly included in SQL statements without proper validation or sanitization.

Can you give me an example of a vulnerable C# code?

Sure! Here's an example:

string query = "SELECT * FROM Users WHERE Username = '" + username + "' AND Password = '" + password + "'";

In this code, if username or password contains malicious SQL code, it can lead to an SQL Injection.

How can I fix this vulnerability?

You can use parameterized queries or prepared statements to prevent SQL Injection. Here's a safer version:

using (SqlCommand cmd = new SqlCommand("SELECT * FROM Users WHERE Username = @username AND Password = @password", connection))
{
    cmd.Parameters.AddWithValue("@username", username);
    cmd.Parameters.AddWithValue("@password", password);
}

Are there any libraries that can help with this?

Yes, you can use libraries like Dapper or Entity Framework, which provide built-in protection against SQL Injection by using parameterized queries.