C# (CSharp) testcases.CWE89_SQL_Injection CWE89_SQL_Injection__Web_Get_Cookies_Web_ExecuteNonQuery_61b.BadSource примеры использования

Пример #1

        public override void Bad(HttpRequest req, HttpResponse resp)
        {
            string data   = CWE89_SQL_Injection__Web_Get_Cookies_Web_ExecuteNonQuery_61b.BadSource(req, resp);
            int?   result = null;

            try
            {
                using (SqlConnection dbConnection = IO.GetDBConnection())
                {
                    dbConnection.Open();
                    using (SqlCommand badSqlCommand = new SqlCommand(null, dbConnection))
                    {
                        /* POTENTIAL FLAW: data concatenated into SQL statement used in ExecuteNonQuery(), which could result in SQL Injection */
                        badSqlCommand.CommandText = "insert into users (status) values ('updated') where name='" + data + "'";
                        result = badSqlCommand.ExecuteNonQuery();
                        if (result != null)
                        {
                            IO.WriteLine("Name, " + data + ", updated successfully");
                        }
                        else
                        {
                            IO.WriteLine("Unable to update records for user: "******"Error getting database connection", exceptSql);
            }
        }