Question for the day

[Jignesh Gor]

How will you secure the website with SQL injection?

This is most critical problem till date for all public facing websites.

[Aalap Shah]

That is achieved mostly by frameworks we use like razor views, entity framework/Linq even IIS.

They all help to prevent sql injection but we have to be careful writing queries eg. Use stored procedures instead of inline queries/use entity sql in entity framework.

Never directly use user input into query, we have to sanitize it first then pass it to database server to query.

On Tuesday, March 8, 2016, Jignesh Gor <jim.j...@gmail.com> wrote:

How will you secure the website with SQL injection?

This is most critical problem till date for all public facing websites.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Aalap Shah

[pate...@gmail.com]

In laymen terms I say that Encode all user input n validate them properly.

Also as Aalap said don't use inline quest like FHEMS apps is using.

And don't give full rights to user account under which you connect to SQL 

Sent from my iPhone

[Jignesh Gor]

Agreed. Sanitize and SP will help till most extent....

Most critical area to protect is login page than any other page....as other pages we know the culprit...but any unknown can damage through login screen as that is the only screen open to public anonymously....

Also, additonal rules by not allowing certain characters in login protects the system....hence in most banking sites does not allow specific characters as username and password...

Also, username should be verified in separate query and password in separate...as it is logical....

Without having some defined rules for characters as input and restrictions on those characters, even SPs will not help...until each parameter is passed in parameter object instead of inline Sp call...let me know if I need example here....

Hope we all remember Target stores sql injection incident during 2014 black Friday....lost billions...in stock value....

[pate...@gmail.com]

Very true.

Sent from my iPhone

[BHAVIN SHAH]

My one cent.

I would argue that don't use inline queries or stored procedure as we mainly .Net Developers are dependent on SPs and Inline Queries. 

In the other side Java developers are not fan of these practice. 

We can change our database communication using LINQ to SQL by passing data using SQL parameters.

 

On Tuesday, March 8, 2016 at 11:21:35 PM UTC-5, Jimi wrote:

Agreed. Sanitize and SP will help till most extent....

Most critical area to protect is login page than any other page....as other pages we know the culprit...but any unknown can damage through login screen as that is the only screen open to public anonymously....

Also, additonal rules by not allowing certain characters in login protects the system....hence in most banking sites does not allow specific characters as username and password...

Also, username should be verified in separate query and password in separate...as it is logical....

Without having some defined rules for characters as input and restrictions on those characters, even SPs will not help...until each parameter is passed in parameter object instead of inline Sp call...let me know if I need example here....

Hope we all remember Target stores sql injection incident during 2014 black Friday....lost billions...in stock value....

On Mar 8, 2016 8:24 PM, <pate...@gmail.com> wrote:

In laymen terms I say that Encode all user input n validate them properly.

Also as Aalap said don't use inline quest like FHEMS apps is using.

And don't give full rights to user account under which you connect to SQL 

Sent from my iPhone

On Mar 8, 2016, at 6:57 PM, Aalap Shah <shah.aa...@gmail.com> wrote:

That is achieved mostly by frameworks we use like razor views, entity framework/Linq even IIS.

They all help to prevent sql injection but we have to be careful writing queries eg. Use stored procedures instead of inline queries/use entity sql in entity framework.

Never directly use user input into query, we have to sanitize it first then pass it to database server to query.

On Tuesday, March 8, 2016, Jignesh Gor <jim.j...@gmail.com> wrote:

How will you secure the website with SQL injection?

This is most critical problem till date for all public facing websites.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Aalap Shah

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

[Aalap Shah]

Using Linq to Sql OR Entity Framework reduces performance and i have seen companies revert back to Stored procedures from Entity framework.

Thanks and Regards,
Aalap Shah

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Aalap Shah

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

[BHAVIN SHAH]

Aalap, 

I completely agree that Entity Framework reduce performance if you are using traditional approach. We had a lot of performance issue when we used it with traditional approach.  Entity framework POCO is the right approach to resolve performance issue as you will be using POCO entities which is really required in your project and this approach will eliminate unnecessary entities which entity framework traditionally creates. 

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Aalap Shah

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-group+unsub...@googlegroups.com.

[Aalap Shah]

Well if we have to do everything on our own then why do we even need EF!!

Thanks and Regards,
Aalap Shah

Aalap, 

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Aalap Shah

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--
You received this message because you are subscribed to the Google Groups "Elite Techie Group" group.

To unsubscribe from this group and stop receiving emails from it, send an email to elite-techie-gr...@googlegroups.com.

[Jignesh Gor]

This is different question...coincidentally I had asked this to Arun....will share some thoughts when get a chance... Busy morning...

[pate...@gmail.com]

I know this we always had this question ,when we started learning MVC 2013 .

You mentioned that Richa's team had same issue ,and then we thought of POCO.

Never use wizard /auto generated things that block your Mind n tie your hands ...

Sent from my iPhone

[SHAH BHAVIN]

Yes, it is correct that auto generated things creates many unnecessary database object and relationship. 

Also, your point is valid that if we do everything then why do we need EF?

most of the people started using this approach, try to create auto generated entities using database first approach by selected limited DB object. than try to modify these autogenerated codes and create your own db entities and remove all edmx and other depended objects.

--
You received this message because you are subscribed to a topic in the Google Groups "Elite Techie Group" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/elite-techie-group/d2_Y7mRneIg/unsubscribe.
To unsubscribe from this group and all its topics, send an email to elite-techie-gr...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Thanks and Regards,
Shah Bhavin
shahb...@gmail.com
http://www.linkedin.com/in/bhavinjshah
732-372-1832(Mobile)