title: Really confused about sql injection
body: <p>Got this detail page about bug that might lead to sql injection</p>
  
  <p>URL encoded GET input classid was set to 1 AND 3*2*1=6 AND 608=608</p>
  
  <p>Tests performed:</p>
  
  <ul>
  <li>1*1*1*1 => TRUE</li>
  <li>1*608*603*0 => FALSE</li>
  <li>11*5*2*999 => FALSE</li>
  <li>1*1*1 => TRUE</li>
  <li>1*1*1*1*1*1 => TRUE</li>
  <li>11*1*1*0*1*1*608 => FALSE</li>
  <li>1 AND 5*4=20 AND 608=608 => TRUE</li>
  <li>1 AND 5*4=21 AND 608=608 => FALSE ... (line truncated)</li>
  </ul>
  
  <p>And this is the source code that might cause the matter:</p>
  
  <pre><code>if (!string.IsNullOrEmpty(Request.QueryString["classid"]))
  {
      string tSql = @" SELECT  [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM  dbo.Web_Award WHERE ClassID={0} ";
  
      DataTable data = DbSession.Default.FromSql(string.Format(tSql, Request.QueryString["classid"])).ToDataTable();
  
      if (data.Rows.Count &gt; 0)
      {
          rptList.DataSource = data;
          rptList.DataBind();
      }
  }
  else
  {
      string tSql = @" SELECT  [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM  dbo.Web_Award  ";
  
      DataTable data = DbSession.Default.FromSql(tSql).ToDataTable();
  
      if (data.Rows.Count &gt; 0)
      {
          rptList.DataSource = data;
          rptList.DataBind();
      }
  }
  </code></pre>
  
  <p>Can anyone tell me how to deal with this...thanks a lot!</p>
  
  <p>Now i have modifeid my code to </p>
  
  <pre><code>if (!string.IsNullOrEmpty(Request.QueryString["classid"]))
          {
              //string tSql = @" SELECT  [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM  dbo.Web_Award WHERE ClassID={0} ";
              string tSql = "SELECT [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM dbo.Web_Award WHERE ClassID = @ClassID";
              //DataTable data = DbSession.Default.FromSql(string.Format(tSql, Request.QueryString["classid"])).ToDataTable();
              SqlConnection connection = new SqlConnection("Server=(local);Integrated Security=SSPI;database=DaysQP");
              connection.Open();
              SqlCommand command = new SqlCommand(tSql, connection);
              command.Parameters.Add(new SqlParameter("@ClassId", System.Data.SqlDbType.Int));
              command.Parameters["@ClassID"].Value = 1;
              using (SqlDataReader dr = command.ExecuteReader())
              {
                  var data = new DataTable();
                  data.Load(dr);
                  if (data.Rows.Count &gt; 0)
                  {
                      rptList.DataSource = data;
                      rptList.DataBind();
                  }
              }
              connection.Close();
          }
          else
          {
              string tSql = @" SELECT  [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM  dbo.Web_Award  ";
              DataTable data = DbSession.Default.FromSql(tSql).ToDataTable();
              if (data.Rows.Count &gt; 0)
              {
                  rptList.DataSource = data;
                  rptList.DataBind();
              }
          }
  </code></pre>
  
  <p>But the problem still exists..</p>
  
  <p>Finally sovled the problem by using parameterized queries!</p>
  
  <pre><code>if (!string.IsNullOrEmpty(Request.QueryString["classid"]))
  {   
      int number;
      bool result = Int32.TryParse(Request.QueryString["classid"], out number);
  
  if (result == false)
  {
      return;
  }
  
  //string tSql = @" SELECT  [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM  dbo.Web_Award WHERE ClassID={0} ";
  string tSql = "SELECT [Award_ID],[Award_Name],[Award_Info],[Award_Pic],[Award_Num],[Award_MoneyCost],[Award_MoneyGet],[Award_Type],[Award_AddDate],[Award_Hot],[Award_OnLineTime],[AwardProP],[PrizeSlidePic],[PrizeDetailPic],[PrizeBigSlidePic],[IsTop],[ClassID] FROM dbo.Web_Award WHERE ClassID = @ClassID";
   //DataTable data = DbSession.Default.FromSql(string.Format(tSql, Request.QueryString["classid"])).ToDataTable();
  
  SqlConnection connection = (SqlConnection)DbSession.Default.CreateConnection();
  //SqlConnection("Server=(local);Integrated Security=SSPI;database=DaysQP");
  connection.Open();
  SqlCommand command = new SqlCommand(tSql, connection);
  command.Parameters.Add(new SqlParameter("@ClassId", System.Data.SqlDbType.Int));
  command.Parameters["@ClassID"].Value = number;
  using (SqlDataReader dr = command.ExecuteReader())
  {
      var data = new DataTable();
      data.Load(dr);
      if (data.Rows.Count &gt; 0)
      {
          rptList.DataSource = data;
          rptList.DataBind();
      }
  }
  connection.Close();
  </code></pre>
  
  <p>}</p>