8 Free SQL Injection Scanners & Tools


SQL injection is a very serious threat in the software and web industry as of current stats. It is also increasingly hitting databases like anything. The process allows miscreants to hack into your system through your web interface. However, the same tools could be used by security pros to find out SQL injection vulnerabilities in the system.

Get it

Leave a comment

Posted by on April 1, 2015 in MS SQL Server


Tags: , , , , , , , ,

Save and retrieve images using Entity Framework C#

If you have an image field in the table, you have to save the image as an array of bytes:

using System.Drawing;
using System.IO;
using System.Drawing.Imaging;
public byte[] ImageToByteArray(Image imageIn)
 var ms = new MemoryStream();
 imageIn.Save(ms, ImageFormat.Png);
 return ms.ToArray();
public Image ByteArrayToImage(byte[] byteArrayIn)
 var ms = new MemoryStream(byteArrayIn);
 var returnImage = Image.FromStream(ms);
 return returnImage;

Regular Expressions Patterns


  • Integer (positive and negative)
    • ^[+-]?\d+$
    • ^[+-]?[0-9]+$
    • Matches: any signed integer
  • Integer (positive)
    • ^[0-9]+$
    • Matches: any positive signed integer
  • Integer (negative)
    • ^[-][0-9]+$
    • Matches: any negative signed integer
  • Decimal (positive and negative)
    • ^[-+]?\d+(\.\d+)?$
    • ^[+-]?[0-9]*(?:\.[0-9]*)?$
    • Matches: 123 | -123.45 | +123.56
  • Decimal (positive)
    • ^[+]?[0-9]*(?:\.[0-9]*)?$
    • Matches: 123 | 123.45 | +123.56
  • Decimal (negative)
    • ^[-][0-9]*(?:\.[0-9]*)?$
    • Matches: -123 | -123.45 | -123.56
  • Number (positive and negative)
    • ^[+-]?([0-9]*\.?[0-9]+|[0-9]+\.?[0-9]*)([eE][+-]?[0-9]+)?$
    • Matches: 23 | -17.e23 | +.23e+2  
  • Natural Number
    • ^[0-9]*[1-9]+$|^[1-9]+[0-9]*$
  • Alphabetical
    • [^a-zA-Z]
    • Matches: ABC | Test | xyz
  • Alphanumeric
    • [^a-zA-Z0-9]
    • ^[a-zA-Z0-9_]*$
    • Matches: ABC | Test123
  • E-Mail
    • ^([a-zA-Z0-9_\-\.]+)@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.)|(([a-zA-Z0-9\-]+\.)+))([a-zA-Z]{2,4}|[0-9]{1,3})(\]?)$
    • Matches:
  • Date
    • ^(((0[1-9]|[12]\d|3[01])\/(0[13578]|1[02])\/((19|[2-9]\d)\d{2}))|((0[1-9]|[12]\d|30)\/(0[13456789]|1[012])\/((19|[2-9]\d)\d{2}))|((0[1-9]|1\d|2[0-8])\/02\/((19|[2-9]\d)\d{2}))|(29\/02\/((1[6-9]|[2-9]\d)(0[48]|[2468][048]|[13579][26])|((16|[2468][048]|[3579][26])00))))|^(0[1-9]|1[012])[- /.](0[1-9]|[12][0-9]|3[01])[- /.](19|20)\d\d+$
    • Matches: this expression validates a date field in dd/mm/yyyy  and mm/dd/yyyy format
  • Temperature
    • ^[-+]?\d*(\.\d+)?( )?(Celsius|C|c|CELSIUS|Fahrenheit|F|f|FAHRENHEIT|Kelvin|K|k|KELVIN)?$
    • Matches: 34F | 56 Celsius | 22C
  • Egyptian National ID
    • (2|3)[0-9][1-9][0-1][1-9][0-3][1-9](01|02|03|04|11|12|13|14|15|16|17|18|19|21|22|23|24|25|26|27|28|29|31|32|33|34|35|88)\d\d\d\d\d
  • Egyptian Mobile Number
    • (201)[0-9]{9}
  • Hexadecimal String
    • ^[0-9A-Fa-f]+$
    • Matches: 062706440644064700200623064306280631

Tags: , , , , , , , , , , , , , , , , , , ,

N-Tier Architecture

N-Tier architecture is an industry-proved software architecture model, suitable to support enterprise-level client/server applications by resolving issues like scalability, security, fault tolerance and etc. .NET has many tools and features, but .NET doesn’t have pre-defined ways to guard how to implement N-Tier architecture. Therefore, in order to achieve good design and implementation of N-Tier architecture in .NET, understanding fully its concepts is very important. However, many of us may hear, read or use N-Tier architecture for many years but still misunderstand its concepts more or less. This article tries to clarify many basic concepts in N-Tier architecture from all aspects, and also provide some practical tips. The tips in this article are based on the assumption that a team has a full control over all layers of the N-Tier architecture.

Read the rest of this entry »


Tags: , , , , , , , , , , , , ,

What’s the difference between LINQ to SQL and Entity Framework?

The first big difference between the Entity Framework and LINQ to SQL is that the EF has a full provider model which means that as providers come online (and there are several in beta now and many which have committed to release within 3 months of the EF RTM), you will be able to use the EF against not only SQL Server and SQL CE but also Oracle, DB2, Informix, MySQL, Postgres, etc.

Next there is the fact that LINQ to SQL provides very limited mapping capabilities.  For the most part L2S classes must be one-to-one with the database (with the exception of one form of inheritance where there is a single table for all of the entity types in a hierarchy and a discriminator column which indicates which type a particular row represents).  In the case of the EF, there is a client-side view engine which can transform queries and updates made to the conceptual model into equivalent operations against the database.  The mapping system will produce those views for a variety of transformations.

Read the rest of this entry »


Tags: , , , , , ,

Difference between POCO, Code First, and simple EF approach

All these three approaches define how much control you want on your Entity Framework code. Entity Framework is an OR mapper, it generates a lot of code, it creates your middle tier (Entity), and Data Access layer (Context).

But a lot of times you want to enjoy the benefits of both worlds, you want the auto-generation part to minimize your development time and you want control on the code so that you can maintain code quality.

Below is the difference table which defines each of the approaches. In simple Entity Framework, everything is auto generated and so you need the EDMX XML file as well. POCO is semi-automatic so you have full control on the entity classes but then the context classes are still generated by the EDMX file.

In Code First, you have complete control on how you can create the entity and context classes. Because you are going to manually create these classes, you do not have dependency on the EDMX XML file. Below is a simple table which shows the cross comparison.

EDMX Entity Context
Simple entity framework Needed Auto Auto
POCO approach Needed Manual Auto
Code First Not Needed Manual Manual

Tags: , , , , ,

Lazy loading in a detailed manner – Entity Framework

By default EF has lazy loading behavior. Due to this default behavior if you are loading a large number of records and especially if they have foreign key relationships, you can have performance issues. So you need to be cautious if you really need lazy loading behavior for all scenarios. For better performance, disable lazy loading when you are loading a large number of records or use stored procedures.

Lazy loading is a concept where we load objects on demand rather than loading everything in one go. Consider a situation where you have 1 to many relationships between the Customer and Address objects. Now let’s say you are browsing the customer data but you do not want address data to be loaded at that moment. But the time you start accessing the address object you would like to load address data from the database.

Entity Framework has lazy loading behavior by default enabled. For instance, consider the below code. When we are doing a foreach on the Customer object, the Address object is not loaded. But the time you start doing foreach on the address collection, the Address object is loaded from SQL Server by firing SQL queries.

So in simple words, it will fire a separate query for each address record of the customer, which is definitely not good for a large number of records.

MyEntities context = new MyEntities();

var Customers = context.Customers.ToList();

foreach (Customercust in Customers) // In this line no address object loaded
     foreach(Address add in cust.Addresses){} // Address object is loaded here

Tags: , , ,