32

I recently notice a lot of "Why doesn't my SQL statement work?" questions, where the cause of the problem is some improperly formatted (date) or improperly escaped (string) value.

Of course, we all know that the real problem is that the OP uses string concatenation to paste user-supplied values into his SQL instead of using parameters, which are not only safer, but also avoid all escaping/formatting issues.

Hence, I'd like to use my dupe hammer to link those questions to some great question explaining generally and in easy terms how to use SQL parameters in C# with SQL Server.

Unfortunately, I have not found such a great question yet - most good, tutorial-like explanations on this subject are off-site. Yes, there are a lot of duplicates, but most are about one very specific issue with a lot of noise, and, thus, not a good dupe target.

Is there a good canonical question for this issue or should I write one?

12
  • 27
    I haven't seen one. Write one, then let us know in an answer. We'll give you lots of downvotes if you did it wrong.
    – user1228
    Commented Feb 1, 2016 at 15:08
  • 4
    The php tag already has a canonical question similar to this. It can be used as a model for the new canonical question. See also technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx and blogs.msdn.com/b/raulga/archive/2007/01/04/…
    – Robert Harvey Mod
    Commented Feb 1, 2016 at 15:53
  • @DavidG: Thanks for the link! I think "how" is the key here: The newbies seldom ask: "How can I prevent SQL injection?" - once they ask that question, we have already won. They ask "Why does my string-concatenated SQL statement not work?" and actually mean "What do I need to do to make my SQL statement work." Once we show them that SQL parameters actually make their task easier (and, as a "side effect", safer), we have them on our side.
    – Heinzi
    Commented Feb 2, 2016 at 7:15
  • I don't really agree with the duplicate, because as @Heinzi indicates that one (and the questions linked to in its answers) explain the "why", not the "how". There is an answer that shows a very basic example, but it doesn't explain anything. Voting to reopen.
    – CodeCaster
    Commented Feb 2, 2016 at 8:45
  • 2
    Everyone loves when their question is marked as a duplicate with a semi-answer linked in. Lets just give up solving problems and write a dictionary.
    – tim
    Commented Feb 2, 2016 at 18:56
  • 1
    @tim write a dictionary? I'm in
    – TylerH
    Commented Feb 2, 2016 at 18:59
  • 4
    Wait! Let's just make a page that covers "How to be happy and successful" and Dupe Link everything to there, because isn't that what all questions are really asking? I hope you see the absurdity in marking all sql param questions as duplicates and linking them to a big honkin' page titled, "How you should be doing it instead" as if that's really your place... (It's not)
    – tim
    Commented Feb 2, 2016 at 19:05
  • @Heinzi You state "I recently notice a lot of "Why doesn't my SQL statement work?" ". Please provide examples (at least 5, but as many as possible). What we do not want is someone using their dupe hammer to close a bunch of questions because they assumed their format issue was the result of unsanitized user input, when it might be the result of something else entirely.
    – Trisped
    Commented Feb 2, 2016 at 19:14
  • @Will: Done. Let the downvotes come. :-)
    – Heinzi
    Commented Feb 2, 2016 at 20:46
  • @Trisped: I see your point, but this is not primarily about unsanitized user input - it is one problem that SQL parameters solve, but not the only one. Again, this is more about the "how" than the "why". I cannot find an example right now (they are hard to search for since they are usually hidden behind bad question titles), but I'll make a note the next time I see one.
    – Heinzi
    Commented Feb 2, 2016 at 20:50
  • As most people reading the answer are likely new to parameterization would it perhaps not be better the introduce Paramaters.Add() as the preferred method rather than AddWithValue() which as you say can cause some quite subtle issues.
    – Alex K.
    Commented Feb 3, 2016 at 14:50
  • @AlexK.: True. On the other hand, Add introduces additional redundancy and is not needed in most of the cases (especially if you already use nvarchars, as is good practice anyway). Personally, I'm in the "use AddWithValue when possible and Add when necessary" camp. I'll see if I can make the Add note more prominent.
    – Heinzi
    Commented Feb 4, 2016 at 8:54

2 Answers 2

21

As the author of How to organize the finding or writing and advertise the existence of canonical questions?, I applaud your question.

Feel free to create a canonical Q&A, I couldn't find one for this subject. Post an answer with the link here when you're done.

When multiple people like it, you can link it from the C# Tag Wiki.

Try to let the canonical answer link to the following pages when relevant (some additions from @Robert's comment):

And please, keep it short, or at least build up from the principles to the more detailed cases.

3
  • 1
    So, how does this tie in with our new 'Documentation' stuff? Can we link this to a Documentation page?
    – DrewJordan
    Commented Feb 1, 2016 at 21:18
  • 1
    @Drew given that's a beta site (and closed beta at that), I wouldn't yet link to it. It may be fine to put the answer in docs, if it fits somewhere.
    – CodeCaster
    Commented Feb 1, 2016 at 21:21
  • Done. Thanks for the links, they've been very helpful!
    – Heinzi
    Commented Feb 2, 2016 at 20:52
7

I created one, here it is:

How can I add user-supplied input to an SQL statement?

I chose the question title deliberately (rather than, e.g. "What it SQL injection and how can I prevent it?") so that that it actually qualifies as a duplicate when some poor soul asks why he cannot get his string-concatenated SQL to work.

Also, I tried to keep the main part short and to the point, so that noobs who don't like to read people who need to solve their immediate problem first and only later read about the theoretical background can quickly see how to use parameterized SQL (by means of an example) and follow the links to more detailed information when they are ready.

Feel free to add your own answers if you think you know how to present the solution in a better way (or improve mine and ping me once it's been completely rewritten so that I can CW it, it's CW).

10
  • Shouldn't the "TL;DR" come before the shortened text and not the long text?
    – Hogan
    Commented Feb 2, 2016 at 20:59
  • @Hogan: It was meant as "This is what you need to read to solve your problem", i.e., a heading for the example section. I see that this might be confusing, so I just replaced it with "Example".
    – Heinzi
    Commented Feb 2, 2016 at 21:06
  • Yeah, "too long didn't read" does not apply to something you want people to read. more like -- "this is as short as I could make it so read it please"
    – Hogan
    Commented Feb 2, 2016 at 21:52
  • 1
    @Hogan Technically, "too long; didn't read" means you've already skimmed past it, so it would belong at the end. Though you're not the first person who expects a summary to precede the work itself, oddly enough. An abstract at the beginning might be helpful if it is overly long, though.
    – TylerH
    Commented Feb 3, 2016 at 15:16
  • The answer would benefit form an oracle example, maybe also a MySql example. Commented Feb 3, 2016 at 15:45
  • @TylerH - "tl;dr can be self-invoked by the original poster as a disclaimer to the readers. It is then paired with a brief summary of the longer original text." See knowyourmeme.com/memes/tldr under usage. This is the only way I've seen it used by an original poster -- in comments it can mean "ignore this" or "boring" or whatever.
    – Hogan
    Commented Feb 3, 2016 at 20:45
  • @Hogan Okay, well any site can just make up definitions. See Urban Dictionary, about as reliable a source as knowyourmeme.com
    – TylerH
    Commented Feb 3, 2016 at 21:23
  • So why won't you CW the whole post? Seems to make sense given the context in which the question was created? Commented Feb 4, 2016 at 8:07
  • @IanRingrose: Good idea. Since I don't have personal experience with C# and Oracle/MySql, do you want to add it? (I've renamed the bottom section to "Other database access libraries"; I think it would fit nicely there.)
    – Heinzi
    Commented Feb 4, 2016 at 8:58
  • It is many years since I used them, so I am not the best person to add the details. One issue is that often the only difference between the sql is how parms are referenced, hence needing tricks with string.replace() Commented Feb 4, 2016 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .