I was looking through some coding standards at my work and I came across this:
string query = "SELECT * FROM USERS WHERE USER_ID='" + userIdFromWebPage + "'";
userIdFromWebPage is a variable that contains untrusted data that has not been validated.
Imagine that it contains one of the following:
- "' or 1=1 -"
- "' ;DROP TABLE users -"
- "' ;exec xp_cmdshell(''format c:') -"
The final query could look like this.
string query = "select * FROM USERS WHERE USER_ID='';exec xp_cmdshell('format c:') -";
This results in a format of the c:\ drive on the database server.
Is that actually true?