Question

I am writing a query to allow a user to search on what they provide keywords in asp.net, C# and mssql:

 string projectPart = null;
 string categoryPart = null;
 string descriptionPart = null;

 if (this.Textbox_ProjectNr.Text.Trim().Length > 0)
   projectPart = " AND Number='" + this.Textbox_ProjectNr.Text.Trim() + "' ";

 if (this.Textbox_Category.Text.Trim().Length > 0)
   categoryPart = " AND Category LIKE '%" + this.Textbox_Category.Text.Trim() + "%' ";

 if (this.Textbox_pDescription.Text.Trim().Length > 0)
    descriptionPart = " AND ProductDescription LIKE '%" + this.Textbox_pDescription.Text.Trim() + "%' ";

 string query = "SELECT * from Project  = p.ID " + projectPart + descriptionPart + categoryPart;

I dont know whether this query is sufficient for a traditional query search. Because I see there are some bottlenecks of this search:

1. if the user does not type anything, it returns all of the data => For this I only do the query when one of the fields are filled.
2. if the user provides some keywords “P” for each field, the result will be millions of data.

I dont know how to improve the search query basically. any suggestions are appreciated.

Thanks in adavance.

Answer 1

The most important improvement is to protect you code against SQL injection attacks.

You should not concatenate the raw input in the SQL string. If someone searches for the following text for example:

Bwah ha ha'; DROP DATABASE northwind; PRINT'

This will be added to your query to produce

SELECT *
FROM mytable
WHERE category LIKE '%Bwah ha ha'; DROP DATABASE northwind; PRINT'%'

This is a valid SQL command and will happily execute and drop your database (or do anything else the attacker wants)

For more information see SQL Injection and Santitizng Inputs.