Question

It doesn’t check for password type. Password may be defined as 4-digit unsigned ints and if a user attempts to change his/her password to something other than 4-digit unsigned ints, then it may cause errors, correct?

If so, what kind of errors?
just a simple error message or can this be a major security issue?
Can someone buffer overflow attack on this?

Answer 1

There can be a major security issue here! More than just a error message. Read more about SQL Injection. The simple rule is that you should always sanitize any string user input to ensure, yes, proper type, but more importantly, that it’s doesn’t bypass your intent and hack into your DB.

A simple Google search returns for example this site.

For .NET, it’s better to use SqlParameter than concatenate string to form your SQL Query. SqlParameter guards you against SQL Injection…

using (SqlCommand cmd = new SqlCommand("UPDATE tblUser SET Password = @password WHERE CustomerID=@custID", conn))
{
   cmd.Parameters.Add(new SqlParameter("password ", newPassword));
   cmd.Parameters.Add(new SqlParameter("custID", custID));
...