Home/ Questions/Q 837525
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T05:09:17+00:00

We are looking at using a library to help us detect SQL injections. We

  • 0

  • We are looking at using a library to help us detect SQL injections.

    • We are using sprocs and parametrized statements, but for the sake of this post that we are only using some sore of library that detects/ verifies user input.

Whats the best one? Easiest to implement? Easiest to update/manage?
Why prefer one over the other?

On a side note:

I’ve just started using Owasp. with C#.
I was hoping that there would be more default rules while validating.
When using the isValid function, there are only 5 default rules.

CREDIT_CARD — Rule name key for the credit card validation rule.
DATE — Rule name key for the date validation rule.
DOUBLE — Rule name key for the double validation rule.
INTEGER — Rule name key for the integer validation rule.
PRINTABLE — Rule name key for the printable validation rule.

I was hoping that there would be more default rules for string SQL Injection Detection.

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Using stored procs is a pretty big step in the right direction. What I’d add to that is input validation which it looks like you’re trying to do with the OWASP ESAPI library but it pretty simple to implement by regex in most cases. You should find plenty of publicly available patterns for most untrusted data.

    The other thing you might want to do is to apply the principle of least privilege at your data layer. Consider using more than one SQL account and restricting the access of your account(s) used by publicly facing users to the absolute bare minimum functions. You’re using stored procs; try and avoid any datareader or datareader rights if you haven’t already.

    More info in OWASP Top 10 for .NET developers part 1: Injection

    • 0