Someone is trying to use SQL injection against the website I work on. I use read-only tables (and Stored Procdedures called with parameters) to mitigate most of this.  However, I do use a DATASET Select statement in parts of the code.

 For example, I have a dataset (small one) that I keep cached (since it's accessed on EVERY page load) and that I use to index the site. As such, I pull queryString items and select from the dataset. Like this:

objMatches = objDS.Tables(0).Select("sec='" & strSection & "' AND sub='" & strSubSection & "'")

Where strSection and strSubSection are items pulled from the QueryString.

 I've answered part of my question myself: there's no way that SQL-injection could do anything to the database since a DataSet is a DISCONNECTED database object! I guess that's another reason to use them, if you can.

The other part of my question: what can I do to eliminate the error that is being thrown? (The error is: "The expression contains undefined function call char().") --The source of the error comes from a SQL-injection attempt on the querystring that makes strSection = "sup AND char(124)+(Select Cast(Count(1) as varchar(8000))+char(124) From [Sysobjects] WHERE 1=1).....more sql".

Any ideas?

TIA

 Hi,

To prevent Sql Ijection is To pass Data As parameter

Or

Put Filter On string example Replace meta and Special and Special words(exe,Drop) etc character and words.

Or

use Microasoft XXS libary

OR

http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx

Chekc Above Article it may have list of words and way prevent The sql ijection..

i have use the logic in 1 of my projects

To avoid SQL Injection use parameterized queries

http://www.aspsnippets.com/post/2009/02/09/Parameterized-Queries-ADONet.aspx

or use stored procedures

http://www.aspsnippets.com/post/2009/05/26/Calling-Select-SQL-Server-Stored-Procedures-using-ADONet.aspx

http://www.aspsnippets.com/post/2009/05/26/Calling-Insert-SQL-Server-Stored-Procedures-using-ADONet.aspx

http://www.aspsnippets.com/post/2009/05/26/Calling-Select-SQL-Server-Stored-Procedures-using-ADONet.aspx

I'm already using parameterized queries to directly query the database and stored procedures to update the database. This is a disconnected DataSet -- I don't think a dataset allows queries OR stored procedures.

 Thanks,

You can query a dataset too

http://msdn2.microsoft.com/en-us/library/system.data.datatable.select.aspx

http://blogs.msdn.com/adonet/archive/2007/01/26/querying-datasets-introduction-to-linq-to-dataset.aspx

http://www.manning-source.com/books/marguerie/bonusch14.pdf