You work as the Enterprise application developer at Domain.com. The Domain.com network consists of a single Active Directory domain named Domain.com. All servers in the domain run Windows Server 2003. Your responsibilities at Domain.com include the testing and stabilization of applications. Domain.com is in the business of retailing music videos online. Your team is currently busy developing a Microsoft ASP.NET Web application that is destined to allow users to purchase music videos online. A Microsoft SQL Server 2005 database is currently used to store the music video data. The Domain.com management wants the application to allow the users to search for music videos by title, artist, and genre. To this end you perform a code review for a page and then discovered the following SQL statement stored in a String variable:
SELECT * FROM Musicvideo WHERE Artist=@Artist
The code makes use of a query string value to create a SqlParameter instance that represents the @Artist parameter. The code then executes the query and displays the results in a GridView control. Now you need to make a decision as to whether the application is vulnerable to a SQL injection attack.
What conclusion can you draw?
A.
The application is not vulnerable to a SQL injection attack.
B.
The application is vulnerable to a SQL injection attack. The SQL statement should be replaced with a function call.
C.
The application is vulnerable to a SQL injection attack. The SQL statement should be replaced with a table-direct call.
D.
The application is vulnerable to a SQL injection attack. The SQL statement should be replaced with a stored procedure call.
Explanation:
SQL injection attacks can occur when an application constructs SQL queries dynamically. In this case this risk is negated by the use of parameterized queries.
Incorrect answers:
B: Replacing the SQL statement with a function call is superfluous since the application makes use of parameterized queries.
C: Replacing the SQL statement with a table-direct call is superfluous since the application makes use of parameterized queries.
D: Replacing the SQL statement with a stored procedure call is superfluous since the application makes use of parameterized queries.