Parametrize Queries to prevent SQL Injection - sql

Question

I know that I need to Parametrize my queries, mainly for safety reasons, and I need help doing so. I'm using VB in visual studio 2012 and SQL Server 2012. I have never done this before and everything I find on the web seems unsuited to my particular code. The bit that I think needs work is the following:
objconnection.Open()
strSQL = "insert into dbo.Event(ID, Name, Summary, Date) values (NEWID(), '" & strName & "','" & strSummary & "','" & strLocation & "','" & strDate & "')"
objcmd = New OleDbCommand(strSQL, objconnection)
objcmd.ExecuteNonQuery()
objconnection.Close()
MsgBox("Event Created", vbMsgBoxSetForeground)
Any pointers greatly appreciated. If you need more of the code let me know!
From comments:
I did look at that and tried it but I had problems. At this part:
.add(new SqlParameter("#strname", '"& strName &"'))
the , between the "#streventname" and '"strName"' is underlined and it says Expression expected.
Also
Dim cmd As SqlCommand = New SqlCommand(cmdText, objconnection)
objconnection gets an error "Value of type 'System.Data.OleDb.OleDbConnection' cannot be converted to 'System.Data.SqlClient.SqlConnection'.
Probably something stupid I've missed out.

Answer 1

You are mixing your SQL-Objects with your OLEDB-Objects. Looks like you are using an OLEDB connection, so that means you have to use OLEDB-Objects, so use OleDbCommand instead of SqlCommand, etc.
Your parameter line should look something like this:
.add(new OleDbParameter("#strname", strName))
For OleDB queries, it is important to realize that the parameters are actually ignoring the name #strname and just updating the parameter information in index order. So the order in which the parameters appear in the sql statement have to be in the same order you supply the parameters.

Answer 2

Thanks you for all the help. I managed to solve it. This is what I now have if anyone is interested.
Imports System
Imports System.Data
Imports System.Data.OleDb
Imports System.Data.SqlClient
Partial Class _Default
Inherits System.Web.UI.Page
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
Dim strName As String = Request.Form("txtName")
Dim strSummary As String = Request.Form("txtSummary")
Dim strDate As String = Request.Form("txtDate")
Dim objconnection As OleDbConnection = Nothing
Dim objcmd As OleDbCommand = Nothing
Dim strconnection As String, strSQL As String
strconnection = "provider=SQLOLEDB;data source=XXX;database=Events;uid=XXX;pwd=XXX;"
objconnection = New OleDbConnection(strconnection)
objconnection.ConnectionString = strconnection
objconnection.Open()
strSQL = "insert into dbo.CreateApp(ID, Name, Summary, Date)values(NEWID(), ?, ?, ?)"
objcmd = New OleDbCommand(strSQL, objconnection)
objcmd.Parameters.Add(New System.Data.OleDb.OleDbParameter("#Name", strName))
objcmd.Parameters.Add(New System.Data.OleDb.OleDbParameter("#Summary", strSummary))
objcmd.Parameters.Add(New System.Data.OleDb.OleDbParameter("#Date", strDate))
objcmd.ExecuteNonQuery()
objconnection.Close()
End Sub
End Class
The key was putting in ?s.

Answer 3

I agree with Lars except you are missing the fact that the sql is wrong. Here is a more complete example.
Dim sql = <value>insert into dbo.Event(ID, Name, Summary, Date) values (NEWID(),#Name,#Summary,#Date)</value>
Using connection As OleDb.OleDbConnection(connectionString)
Using command As New OleDb.OleDbCommand(sql.Value, connection)
command.Parameters.AddWithValue("#Name", nameValue)
command.Parameters.AddWithValue("#Summary", summaryValue)
command.Parameters.AddWithValue("#Date", DateValue)
command.ExecuteNonQuery()
End Using
End Using
If you want to not bother with ADO and are looking for something simpler I recommend using Simple.Data http://simplefx.org/simpledata/docs/. It is by far one of the simplest ways to interact with a database without having to now SQL or ADO but it certainly does help.
Good Luck