insert code - security

[Eugene Anthony]

How do I secure the code bellow from possible sql injection?

SqlConnection cnn2 = new
SqlConnection(ConfigurationManager.ConnectionStrin gs["myConnection"].Con
nectionString);
SqlCommand myCommand2 = new SqlCommand();
myCommand2.Connection = cnn2;
myCommand2.CommandText = "INSERT Authentication (email,
firstname,lastname,password,country,postalcode,dob ,Gender,type)
VALUES('" + email + "','" + firstname + "','" + lastname + "','" +
password + "','" + country + "'," + int.Parse(postalcode) + "," + dob +
",'" + gender + "','user')";
SqlDataAdapter myAdapter2 = new SqlDataAdapter(myCommand2);
DataSet ds2 = new DataSet();
myAdapter2.Fill(ds2, "Authentication");

Please note that im using ms sql 7 along with asp.net 2.0 with C#.

Eugene Anthony

*** Sent via Developersdex http://www.developersdex.com ***

[Jay Allard]

Remove all of the variables from the Insert statement.

Instead of

sql = "insert into authetnication(email) values('" + email + ")")

do

sql = insert into authetnciation(email) values (@email)

Then create a sqlparameter with a name of email, and the proper data type
and size, and add it to the command parameters collection.

"Eugene Anthony" <so***********@yahoo.comwrote in message
news:%2*****************@TK2MSFTNGP06.phx.gbl...

How do I secure the code bellow from possible sql injection?

SqlConnection cnn2 = new
SqlConnection(ConfigurationManager.ConnectionStrin gs["myConnection"].Con
nectionString);
SqlCommand myCommand2 = new SqlCommand();
myCommand2.Connection = cnn2;
myCommand2.CommandText = "INSERT Authentication (email,
firstname,lastname,password,country,postalcode,dob ,Gender,type)
VALUES('" + email + "','" + firstname + "','" + lastname + "','" +
password + "','" + country + "'," + int.Parse(postalcode) + "," + dob +
",'" + gender + "','user')";
SqlDataAdapter myAdapter2 = new SqlDataAdapter(myCommand2);
DataSet ds2 = new DataSet();
myAdapter2.Fill(ds2, "Authentication");

Please note that im using ms sql 7 along with asp.net 2.0 with C#.

Eugene Anthony

*** Sent via Developersdex http://www.developersdex.com ***

[daniel #]

The better way is using stored procedures.

Regards
daniel #

"Eugene Anthony" <so***********@yahoo.comwrote in message
news:%2*****************@TK2MSFTNGP06.phx.gbl...

How do I secure the code bellow from possible sql injection?

SqlConnection cnn2 = new
SqlConnection(ConfigurationManager.ConnectionStrin gs["myConnection"].Con
nectionString);
SqlCommand myCommand2 = new SqlCommand();
myCommand2.Connection = cnn2;
myCommand2.CommandText = "INSERT Authentication (email,
firstname,lastname,password,country,postalcode,dob ,Gender,type)
VALUES('" + email + "','" + firstname + "','" + lastname + "','" +
password + "','" + country + "'," + int.Parse(postalcode) + "," + dob +
",'" + gender + "','user')";
SqlDataAdapter myAdapter2 = new SqlDataAdapter(myCommand2);
DataSet ds2 = new DataSet();
myAdapter2.Fill(ds2, "Authentication");

Please note that im using ms sql 7 along with asp.net 2.0 with C#.

Eugene Anthony

*** Sent via Developersdex http://www.developersdex.com ***