Search code examples
c#asp.netsqlsql-server-2008parameterized-query

Opening angle bracket "<" in user input causes a 404 error


The .net app I am working on encounters an error when a user enters opening angle brackets "<" as input. Specifically this occurs when they want some sort of html input such as <a href="www.google.com">Google</a>

I've tried the exact same input without the "<" and everything works exactly as it should. The input is being read from an asp:TextBox and added as a parameter to an SQL INSERT INTO statement. I am using a try catch block to catch SqlException's, but this particular problem is not even caught when I change catch statement to catch(Exception err). I know "<" is used as the less than operated in SQL however, it shouldn't be a problem because the input is a parameter right? Why would it only be the "<" and not ">" which also are in the input since both characters are valid SQL operators? Here is the actual code snippet.

try
{
    SQL_Command.Connection = SQL_Connection;
    SQL_Command.CommandText = "INSERT INTO tabl1 ([ID], [fName], [lName], [bio]) VALUES (@ID, @First, @Last, @Bio)";
    SqlParameter ID, First, Last, Bio;
    ID = new SqlParameter("@ID", id_text.Text);
    First = new SqlParameter("@First", firstName_Text.Text);
    Last = new SqlParameter("@Last", lastName_Text.Text);
    Bio = new SqlParameter("@Bio", bio_Text.Text);
    SQL_Command.Parameters.Add(ID)
    SQL_Command.Parameters.Add(Last)
    SQL_Command.Parameters.Add(First)
    SQL_Command.Parameters.Add(Bio)
    SQL_Command.ExecuteNonQuery();
}
catch (Exception err)
{
    Response.Write(err);
}

The schema for this table is:

ID int NOT NULL
fName nVarChar(255)
lName nVarChar(255)
bio nVarChar(MAX)

Solution

  • The error message your are getting is most likely the result of ASP Net protecting your site against a cross site scripting attack. The opening of the angle bracket looks suspicious, because you may be injecting malicious javascript or HTML onto the page. This question has been answered before at this link: A potentially dangerous Request.Form value was detected from the client

    Hope that helps !