Search code examples
c#sqlasp.netoledb

Why is my response always 0 after using parameters in OleDB?

I have a simple .aspx login website and I use OleDB for local validation.

Here is my problem: After finding SQL Injection vulnerability, I decided to use parameters. But after using parameters my response is always "0" (Same as "Authenticated=false"). But if I don't use parameters, my response is "1" (Same as "Authenticated=true").

Here some pics while debugging:

Without parameters where the response=1 (Authenticated): Without parameters

With code:

string idstr = Request.QueryString["id"];
            idstr.Replace("''", "");
            string passpath = Request.QueryString["password"];
            passpath.Replace("''", "");

            OleDbConnection connect = new OleDbConnection();
            OleDbCommand cmd = new OleDbCommand();
            connect.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0; Data Source= C:\Users\hugow_000\Desktop\OSGS_Kantine_htm_design\Kantine_data.accdb; Persist Security Info = False;";
            cmd.Connection = connect;
            connect.Open();
            cmd.CommandText = "select * from User_data where Stamnummer="+idstr+" and Wachtwoord="+ passpath;

            OleDbDataReader read = cmd.ExecuteReader();
            int code = 0;
            while (read.Read())
            {
                code = code + 1;
            }
            if (code == 1)
            {
                Response.Redirect("~/AuthKeyGEN.aspx?Auth=true&id=" + idstr + "&password=" + passpath + "");

            }
            if (code > 1)
            {
                Response.Redirect("~/Login.aspx?response=0");
            }
            if (code < 1)
            {
                Response.Redirect("~/Login.aspx?response=0");
            }
        }

And with parameters where the response is 0 (Not Authenticated): With parameters

And with code:

string idstr = Request.QueryString["id"];
            idstr.Replace("''", "");
            string passpath = Request.QueryString["password"];
            passpath.Replace("''", "");

            OleDbConnection connect = new OleDbConnection();
            OleDbCommand cmd = new OleDbCommand();
            connect.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0; Data Source= C:\Users\hugow_000\Desktop\OSGS_Kantine_htm_design\Kantine_data.accdb; Persist Security Info = False;";
            cmd.Connection = connect;
            connect.Open();
            cmd.CommandText = "select * from User_data where Stamnummer=@idstr and Wachtwoord=@passpath";
            cmd.Parameters.Add("@idstr", OleDbType.BSTR).Value = idstr;
            cmd.Parameters.Add("@passpath", OleDbType.BSTR).Value = passpath;

            OleDbDataReader read = cmd.ExecuteReader();
            int code = 0;
            while (read.Read())
            {
                code = code + 1;
            }
            if (code == 1)
            {
                Response.Redirect("~/AuthKeyGEN.aspx?Auth=true&id=" + idstr + "&password=" + passpath + "");

            }
            if (code > 1)
            {
                Response.Redirect("~/Login.aspx?response=0");
            }
            if (code < 1)
            {
                Response.Redirect("~/Login.aspx?response=0");
            }
        }

I am using the same credentials in both scenarios, So why is my response always 0 if I use parameters in here?

Thanks in advance!

Solution

  • Doesn't look anything wrong but try using OleDbType.VarChar instead of OleDbType.BSTR since both the parameter are of string type; like

    cmd.Parameters.Add("@idstr", OleDbType.VarChar).Value = idstr;
cmd.Parameters.Add("@passpath", OleDbType.VarChar).Value = passpath;

    Also as a side note, instead of using select * use a count() query like below in which case you can use ExecuteScalar() rather than using ExecuteReader()

    "select count(*) from User_data 
where Stamnummer=@idstr and Wachtwoord=@passpath";