title: Testing if Request.QueryString is vulnerable to SQL Injection
body: <p>How can I test my page that uses that uses <code>Request.QueryString.Get("ID")</code> against SQL Injections. I have tried a few basic things like <code>www.myDomain/mySite.aspx?ID=1234'</code> and <code>www.myDomain/mySite.aspx?ID=1234'</code>, neither of which causes anything unexpected. I'm looking for a definitive way to test for vulnerabilities though. According to this <a href="https://stackoverflow.com/questions/568995/best-way-to-defend-against-mysql-injection-and-cross-site-scripting">post</a> it looks like I have implemented the correct mechanisms to prevent injection. Besides online articles I do not have practical experience testing this.</p>
  
  <p>I am using 2 defense mechanisms which seem to be fairly common</p>
  
  <p>1.) I have a sanitize function which removes single apostrophes and '&amp;' and does some formatting stuff to the query string before it is ever added the the SQL Command.</p>
  
  <p>2.) I am also using parameterized statements so the Query String becomes a parameter for the command that is executed. I understand this make the whole process more secure because the query structure is already defined.</p>