SQL Injection on dataquery and repeater

Jackie Chan asked on June 4, 2020 12:40

My Site get reported to be vunerable to SQL injection.

I use DataQuery and basic repeater web part.

In the DataQuery webpart, I set the where condition as follow:

m.SPWDiseaseGuid = '{? guid ?}' AND l.FK_CultureID = '{% DocumentContext.CurrentDocumentCulture.ID #%}'

and the guid which is from query string is vulnerable to SQL Injection.

Is there anything I can do?

I am using Kentico 9.

sql injeciton

Correct Answer

Peter Mogilnitski answered on June 4, 2020 15:38

In macros sql injection protection is enabled by default, this is applied to macros entered into the WhereCondition, OrderBy and Columns web part properties. You dont have to do anything. Here is the documentation

0 votesVote for this answer Unmark Correct answer

Recent Answers

Dmitry Bastron answered on June 4, 2020 13:16

Hi Jackie,

Please read through this Kentico documentation article, it explains how to protect your parameters. In a nutshell you should be using macro like this instead of {%param%}:

{% SQLEscape(QueryString.GetValue("guid", ""))#%}

0 votesVote for this answer Mark as a Correct answer

Juraj Ondrus answered on June 5, 2020 08:53

Just to add what was said above, check the blog posts from our security expert too!

0 votesVote for this answer Mark as a Correct answer