Avoiding SQL Injection in SQL query with Like Operator using parameters?

Posted by MikeJ on Stack Overflow See other posts from Stack Overflow or by MikeJ
Published on 2008-10-23T03:46:20Z Indexed on 2010/03/27 8:43 UTC
Read the original article Hit count: 226

Filed under:

ADO.NET

|

sql-injection

|

query

|

like

|

search

Taking over some code from my predecessor and I found a query that uses the Like operator:

SELECT * FROM suppliers WHERE supplier_name like '%'+name+%';

Trying to avoid SQL Injection problem and parameterize this but I am not quite sure how this would be accomplished. Any suggestions ?

note, I need a solution for classic ADO.NET - I don't really have the go-ahead to switch this code over to something like LINQ.

© Stack Overflow or respective owner

Related posts about ADO.NET

Asp.net ADO.NET Entity Framework or ADO.NET

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm starting a new project based on ASP.NET and Windows server. The application is planned to be pretty big and serve large amount of clients pulling and updating high freq. changing data. I have previously created projects with Linq-To-Sql or with Ado.Net. My plan for this project is to use VS2010… >>> More
ADO.NET Entity Framework or ADO.NET

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm starting a new project based on ASP.NET and Windows server. The application is planned to be pretty big and serve large amount of clients pulling and updating high freq. changing data. I have previously created projects with Linq-To-Sql or with Ado.Net. My plan for this project is to use VS2010… >>> More
RIA Services vs ADO.NET Data Services

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm currently in the process of creating a Silverlight 3 data driven application. To access the database, 2 common approaches are used: RIA Services and ADO.NET Data Services. Does anyone have any guidance on when/why to choose each approach? Here is what I've gathered from my research / experience… >>> More
Ado.net dataservices BeginExecuteBatch call works on development fails on production server with Obj

as seen on Stack Overflow - Search for 'Stack Overflow'
We have an ado.net dataservices 1.0 call that is being passed to a [WebGet] service operation as a batch through BeginExecuteBatch. Everything works perfectly on our development server - we have the project configured to use IIS instead of the cassini web server to make it as close to our production… >>> More
ADO.Net : Get table definition from SQL server tables

as seen on Stack Overflow - Search for 'Stack Overflow'
I am using C# to write a method that returns the following information about a table: column names, column types, column sizes, foreign keys. Can someone point me in the right direction on how to accomplish this ? >>> More

Related posts about sql-injection

Is this query vulnerable to sql injection?

as seen on Stack Overflow - Search for 'Stack Overflow'
$myq = sprintf("select user from table where user='%s'", $_POST["user"]); I would like to know if the above query can be exploited using SQL injection. Is there any advanced SQL injection technique that could break sprintf for this particular query? >>> More
10 Ways to Prevent or Mitigate SQL Injection Attacks

as seen on Internet.com - Search for 'Internet.com'
SQL injection attacks could allow hackers to compromise your network, access and destroy your data, and take control of your machines. >>> More
10 Ways to Prevent or Mitigate SQL Injection Attacks

as seen on Internet.com - Search for 'Internet.com'
SQL injection attacks could allow hackers to compromise your network, access and destroy your data, and take control of your machines. >>> More
Database Activity Monitoring Part 2 - SQL Injection Attacks

as seen on SQL Server Central - Search for 'SQL Server Central'
If you think through the web sites you visit on a daily basis the chances are that you will need to login to verify who you are. In most cases your username would be stored in a relational database along with all the other registered users on that web site. Hopefully your password will be encrypted… >>> More
SQL Server SQL Injection from start to end

as seen on SQL Team - Search for 'SQL Team'
SQL injection is a method by which a hacker gains access to the database server by injecting specially formatted data through the user interface input fields. In the last few years we have witnessed a huge increase in the number of reported SQL injection attacks, many of which caused a great deal… >>> More