<\/div>\n

Bu yaz\u0131mda SQL Injection’dan bahsedece\u011fim.SQL Injection \u00f6zellikle web uygulamalar\u0131ndaki en ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131ndan biridir.E\u011fer SQL sorgular\u0131m\u0131z i\u00e7ine programdan de\u011fer al\u0131rken o de\u011feri + operat\u00f6r\u00fc ile ekliyorsak sorgumuza d\u0131\u015fardan her t\u00fcrl\u00fc m\u00fcdahale yap\u0131lmas\u0131na imkan vermi\u015f oluyoruz.
\n
\nSQL Server da sorgular aras\u0131na ; koyarak tek seferde birden fazla sorgu \u00e7al\u0131\u015ft\u0131rabiliriz.\u00d6rne\u011fin a\u015fa\u011f\u0131daki kod blo\u011funu inceleyiniz.TextBox’a girilen de\u011fere g\u00f6re bir select sorgusu d\u00f6nmektedir.<\/p>\n

\r\nSqlConnection baglanti = new SqlConnection("Server=GEN\u00c7AY-GEN\u00c7AY;database=Northwind;trusted_connection=true;");\r\n            baglanti.Open();\r\n            SqlCommand cmd = new SqlCommand("Select Adi,Soyadi from Personeller where PersonelId = '" + textBox1.Text + "'", baglanti);\r\n            SqlDataReader dt = cmd.ExecuteReader();\r\n            while (dt.Read())\r\n            {\r\n                MessageBox.Show(dt["Adi"].ToString() + " " + dt["Soyadi"].ToString());\r\n            }\r\n            baglanti.Close();\r\n            baglanti.Dispose();\r\n<\/pre>\nYukardaki yap\u0131da sorguyu incelerseniz e\u011fer + operat\u00f6r\u00fc kullanarak TextBox’a girilen de\u011feri vermeteyiz.Burada \u015f\u00f6yle bir uyan\u0131kl\u0131k yapabiliriz.TextBox’uma “7;delete from Personeller” yazarsam e\u011fer,arka planda \u00e7al\u0131\u015ft\u0131r\u0131lacak sorgu \u015fu olacakt\u0131r;
\n“Select Adi,Soyadi from Personeller where PersonelId=’7′;delete from Personeller” yani \u00f6nce \u015farta uygun tabloyu se\u00e7ecek,sonrada Personeller tablosundaki b\u00fct\u00fcn kay\u0131tlar\u0131 silecek.
\nBu b\u00fcy\u00fck bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r.Bunun \u00e7aresi ise, sorgular\u0131m\u0131za d\u0131\u015far\u0131dan de\u011fer al\u0131rken kesinlikle + operat\u00f6r\u00fc ile almayaca\u011f\u0131z.De\u011fer al\u0131rken parametre olarak alaca\u011f\u0131z ve sorguya o parametreyi g\u00f6nderece\u011fiz.<\/p>\n
\r\nSqlConnection baglanti = new SqlConnection("Server=GEN\u00c7AY-GEN\u00c7AY;database=Northwind;trusted_connection=true;");\r\n            baglanti.Open();\r\n            SqlCommand cmd = new SqlCommand("Select Adi,Soyadi from Personeller where PersonelId = @id", baglanti);\r\n            cmd.Parameters.Add("@id", textBox1.Text);\r\n            SqlDataReader dt = cmd.ExecuteReader();\r\n            while (dt.Read())\r\n            {\r\n                MessageBox.Show(dt["Adi"].ToString() + " " + dt["Soyadi"].ToString());\r\n            }\r\n            baglanti.Close();\r\n            baglanti.Dispose();\r\n<\/pre>\nYukarda g\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi @id parametresi tan\u0131mlanm\u0131\u015ft\u0131r.E\u011fer SqlCommand nesnesi i\u00e7inde parametre varsa Execute etmeden \u00f6nce o parametreyi SqlCommand nesnesine tan\u0131tmam\u0131z laz\u0131m.Bunuda Parameters koleksiyon yap\u0131s\u0131yla yap\u0131yoruz.<\/p>\n","protected":false},"excerpt":{"rendered":"
Bu yaz\u0131mda SQL Injection’dan bahsedece\u011fim.SQL Injection \u00f6zellikle web uygulamalar\u0131ndaki en ciddi g\u00fcvenlik a\u00e7\u0131klar\u0131ndan biridir.E\u011fer SQL sorgular\u0131m\u0131z i\u00e7ine programdan de\u011fer al\u0131rken o de\u011feri + operat\u00f6r\u00fc ile ekliyorsak sorgumuza d\u0131\u015fardan her t\u00fcrl\u00fc m\u00fcdahale yap\u0131lmas\u0131na imkan vermi\u015f...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,22],"tags":[129,131,135],"class_list":["post-197","post","type-post","status-publish","format-standard","hentry","category-c-sharp-c","category-veritabani","tag-ado-net","tag-connected","tag-sql-injection"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/197","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=197"}],"version-history":[{"count":0,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/197\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=197"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=197"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=197"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}