Is .NET less vulnerable to application security hacks?

Is .NET less vulnerable to application security hacks?

Does coding in .NET prevent me from being vulnerable to common application hacks such as SQL injection and cross-site scripting?

    Requires Free Membership to View

    Login

    When you register, you'll receive targeted emails designed to keep you informed of the most relevant information on Agile development, application security, testing & QA, software requirements, and more.

    Hannah Smalltree, Editorial Director

    By submitting your registration information to SearchSoftwareQuality.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSoftwareQuality.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

.NET actually does help you from being vulnerable to cross-site scripting, or XSS. The web.config file has page validation turned on by default, which will return an error anytime input is seen to contain script. This is a nice feature, as it shows how building security into the language can help in cutting down security holes drastically.

As for SQL injection, unfortunately there is no easy solution. The remediation for SQL injection is the same for .NET as it is with any other language. Validate user input and use parameterized queries. As is the case with.NET and XSS, I predict a solution will also end up being integrated right into the language so that anytime developers make calls to the database this will all be done automatically to ensure secure code.

More information:
* ASP.NET tool upgrade: Compuware releases SecurityChecker 2.5
* Discover the power of .NET's code access security
* Developing secure .NET applications

This was first published in January 2006