sql insert method fails when using ecrypted string

Question

I'm using md5 to ecnrypt the user password. But whenever I try to add any records my code is throwing an error "Syntax error in INSERT INTO statement."

Here's my code

    public int InsertUser(string lastName, string firstName, string username, string password, bool isAdmin)
    {
        OleDbConnection conn = new OleDbConnection(connStr);
        conn.Open();

        string encryptPassword = encryptMD5(username,password).ToString();
        OleDbCommand  dCmd = new OleDbCommand("INSERT INTO Users (LastName, FirstName, UserName, Password) " +
                                            "VALUES ('" + lastName + "','" + firstName + "','" + username + "','" + encryptPassword + "')", conn);

        dCmd.CommandType = CommandType.Text;
        try
        {
            return dCmd.ExecuteNonQuery();
        }
        catch
        {
            throw;
        }
        finally
        {
            dCmd.Dispose();
            conn.Close();
            conn.Dispose();
        }
    }

    private string encryptMD5(string username, string sPassword)
    {
        System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider();
        byte[] bs = System.Text.Encoding.UTF8.GetBytes(sPassword + username);
        bs = x.ComputeHash(bs);
        System.Text.StringBuilder s = new System.Text.StringBuilder();
        foreach (byte b in bs)
        {
            s.Append(b.ToString("x2").ToLower());
        }
        return s.ToString();
   }

Answer 1

Try this below, it ensure that all parameters are properly enclosed and escaped.

try
{
    using (OleDbConnection conn = new OleDbConnection(connStr))
    {
        conn.Open();

        string encryptPassword = encryptMD5(username, password).ToString();

        using (OleDbCommand dCmd = new OleDbCommand(
            "INSERT INTO Users (LastName, FirstName, UserName, Password) " +
            "VALUES (?, ?, ?, ?)", conn))
        {
            dCmd.CommandType = CommandType.Text;

            OleDbParameter p;

            dCmd.Parameters.Add(p = new OleDbParameter("@lastName", OleDbType.VarChar));
            p.Value = lastName;

            dCmd.Parameters.Add(p = new OleDbParameter("@firstName", OleDbType.VarChar));
            p.Value = firstName;

            dCmd.Parameters.Add(p = new OleDbParameter("@username", OleDbType.VarChar));
            p.Value = username;

            dCmd.Parameters.Add(p = new OleDbParameter("@encryptPassword", OleDbType.VarChar));
            p.Value = encryptMD5(username, password);

            return dCmd.ExecuteNonQuery();
        }
    }
}
catch
{
    throw; // here should be better exception handling
}

Answer 2

You have a problem of higher level. You should never create a SQL statement by concatenation of statement and values. You should bind values as parameters, then underlying framework will handle parameters and even provide them separately from the SQL statement to the server. It is much more secure way (no SQL injection is possible), with better performance and you will not get into these types of error.

If you want to understand the reason for the problem, then you should look into the actual insert statement you create and the problem will become obvious

    "INSERT INTO Users (LastName, FirstName, UserName, Password) " + "VALUES ('" + lastName + "','" + firstName + "','" + username + "','" + encryptPassword + "')"

It is likely that the result of your MD5 hash or other parameters somehow breaks the SQL INSERT syntax. (it should not in most of the cases, you should provide the actual values) You should try to execute the resulting query on the actual database to see the actual error in returns (use SQL Server Management Studio for example)

To bind parameters you should use something like that:

    dCmd.Parameters.Add(new OleDbParameter("@username",username)); 

See some MSDN reference: OleDbCommand Parameters