Data Base Security

 DataBase Security is one of the important parts in web development. 

Inorder to maintain that, the vulnerable code like Data base path , query or etc is written inside the Class file in the form of functions and in the needy page they are only called.

How to create Class file-

Select the root > go to website menu > Add new item >Select class > give a desired name to class(lets say MyClass)

Inside it write the code for Object creation and library inclusion.

After that, create the function for each thing-

1. For connection- 

public string Connection()

{

string cs = @"data_base_path";

return cs;

}

 2. For query-

Insert-

public string Insertq()

{ 

string q = "insert into Table_name values"; 

return q;

}  

Update-

public string Updateq()

{ 

string q = "update Table_name set"; 

return q;

}  

Select-

public string Selectq()

{ 

string q = "select * from Table_name where"; 

return q;

}   

Delete-

public string Deleteq()

{ 

string q = "delete from Table_name where"; 

return q;

}   

Note:- We need to return something in the function as its return type is string here.

How to call it in aspx file-

1. For connection- 

// Create an object of the class where we defined our functions

MyClass m1 = new MyClass();

string cs= m1.connection();

cn = new SqlConnection(cs); 

cn. open();

2. For query- 

Insert-

string q = m1.Insertq() + "('"+control _name+"')";

cm = new SqlCommand(q,cn);

cm.ExecuteNonQuery();

Update- 

string q = m1.updateq() + " " + "column_name='"+Control_name.Text+"' where id='"+control_name.Text+"'";

cm = new SqlCommand(q,cn);

cm.ExecuteNonQuery(); 

Delete- 

string q = m1.Deleteq() + " " + "column_name='"+Control_name+"'";

cm = new SqlCommand(q,cn);

cm.ExecuteNonQuery();

Select- 

string q = m1.Selectq() + " " + "column_name='"+Control_name+"'";

cm = new SqlCommand(q,cn);

cm.ExecuteReader();