Make Vulnerable to SQL Injection

[Jack Soo Chien Wei]

Hi guys. After testing few of SQL injection in my login page, it seems the SQL injection doesn't work which is good things.
However now if I want to make my login page vulnerable to SQL injection, because one of my software security assignment task is to find out weaknesses of OWASP TOP 10 weaknesses from our own developed application.
Below is my login page code:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Web.Security;

namespace SSBakery
{
    public partial class Login : System.Web.UI.Page
    {
        BakeryDataContext db = new BakeryDataContext();
        SqlConnection con = new SqlConnection(@"Data Source=(LocalDB)\mssqllocaldb;AttachDbFilename=C:\Users\Win7\Documents\SSBakery\SSBakery\SSBakery\App_Data\Bakery.mdf;Integrated Security= True");


        protected void Page_Load(object sender, EventArgs e)
        {
            System.Web.UI.HtmlControls.HtmlLink css = new System.Web.UI.HtmlControls.HtmlLink();
            css.Href = "/css/yourcss.css";
            css.Attributes["rel"] = "stylesheet";
            css.Attributes["type"] = "text/css";
            // css.Attributes["media"] = "all"; //add any attributes as needed
            Master.Page.Header.Controls.Add(css);
        }

        protected void btnLogin_Click(object sender, EventArgs e)
        {
            if (Page.IsValid)
            {


                string username = txtUsername.Text;
                string password = txtPassword.Text;
                bool rememberMe = chkRememberMe.Checked;

                // Login the user
                User u = db.Users.SingleOrDefault(
                     x => x.Username == username &&
                          x.mPassword == password
                          );

                if (u != null)
                {
                    Session["username"] = txtUsername.Text;
                    if (u.Role == "Staff")
                    {
                        DataAccess.LoginUser(u.Username, u.Role, rememberMe);
                        Response.Redirect("/StaffOnly/StaffHome.aspx");
                    }
                    else if (u.Role == "Member")
                    {
                        DataAccess.LoginUser(u.Username, u.Role, rememberMe);
                        Response.Redirect("/MemberOnly/MemberHome.aspx");
                    }
                    else if (u.Role == "Manager")
                    {
                        DataAccess.LoginUser(u.Username, u.Role, rememberMe);
                        Response.Redirect("/ManagerOnly/ManagerHome.aspx");
                    }
                }

                else
                {

                    cvNotMatched.Visible = true;
                    cvNotMatched.IsValid = false;
                }

            }

              
            }
        }
    }

[Jeanne Boyarsky]

Jack,
You need to have a SQL statement in your code in order to be vulnerable to SQL Injection. I know how to do this Java, but not C# so I googled.

It looks like the way to do that is with a SQLCommand class. Here's an example

[Stephan van Hulst]

It looks like you're using Entity Framework, which creates SQL queries itself and protects you from SQL injection attacks.

You have a different problem though. You are storing your users' passwords in the database. Don't store passwords, encrypted or not.

It's easiest if you add ASP.NET Identity to your OWIN pipeline. If you don't have OWIN, get an implementation like Katana.