# SQL Injection Tabbed Demo

A Windows Forms .NET application demonstrating the difference between vulnerable and secure SQL queries using the AdventureWorks2022 database.

## Overview

This application provides a side-by-side comparison of:
- **Vulnerable Query Tab**: Shows how string concatenation creates SQL injection vulnerabilities
- **Secure Query Tab**: Demonstrates proper parameterized queries that prevent SQL injection

The demo uses the `Production.Product` table from the **AdventureWorks2022** sample database.

## Project Structure

- `Form1.cs` - Main form with business logic
- `Form1.Designer.cs` - Windows Forms designer code  
- `Program.cs` - Application entry point
- `SqlInjectionTabbedDemo.csproj` - Project file

## Database Setup

### Option 1: AdventureWorks2022 Database
1. Download and install the AdventureWorks2022 sample database from Microsoft
2. Restore it to your `.\SQL02` SQL Server instance
3. The application will connect to `Production.Product` table

### Option 2: Demo Mode (No Database Required)
The application includes built-in sample data that activates automatically if no database connection is available.

## How to Run

### From VS Code:
1. Press `Ctrl+Shift+P` and run "Tasks: Run Task" 
2. Select "Build SqlInjectionDemo"
3. Run: `dotnet run`

### From Command Line:
```bash
cd "c:\Demo\SqlInjection"
dotnet build
dotnet run
```

## Testing SQL Injection

### Vulnerable Tab:
- **Normal Input**: Enter "Road" → Shows road bike products
- **SQL Injection**: Enter `Road' OR '1'='1` → Shows all products (vulnerability demonstrated)
- **Malicious Input**: Enter `'; DROP TABLE Production.Product; --` → Would attempt to delete data (in real scenario)

### Secure Tab:
- **Normal Input**: Enter "Road" → Shows road bike products  
- **SQL Injection Attempt**: Enter `Road' OR '1'='1` → Returns only products containing "Road' OR '1'='1" (protected)
- **All Malicious Input**: Treated as literal text, safely parameterized

## Key Learning Points

1. **Vulnerable Code**: String concatenation allows injection
   ```csharp
   string sql = "SELECT ProductID, Name, ListPrice, ProductNumber FROM Production.Product WHERE Name LIKE '%" + userInput + "%'";
   ```

2. **Secure Code**: Parameterized queries prevent injection
   ```csharp
   string sql = "SELECT ProductID, Name, ListPrice, ProductNumber FROM Production.Product WHERE Name LIKE @name";
   cmd.Parameters.AddWithValue("@name", "%" + userInput + "%");
   ```

## Security Notes

- The vulnerable tab is intentionally insecure for educational purposes
- Never use string concatenation for SQL queries in production
- Always use parameterized queries or stored procedures
- Validate and sanitize all user inputs
- Apply principle of least privilege to database connections

## Requirements

- .NET 8.0 or later
- Windows OS (for Windows Forms)
- SQL Server with AdventureWorks2022 database (optional - demo mode works without database)
- SQL Server instance: `.\SQL02`

## Warning

This application contains intentionally vulnerable code for educational purposes only. Do not use the vulnerable patterns in production applications.