November Happy Hour will be moved to Thursday December 5th.

SQL injection exception when creating dynamic data store

Vote:
 

Hello!

I'm trying to create a Dynamic Data Store in Episerver CMS6 to store number of visits to certain pages, but I'm getting the following exception:

Exception Details: System.ArgumentException: Contains potentially dangerous (SQL Injection) characters
Parameter name: storeName

My code looks like this:


 protected List<ProjectVisits> GetProjectsVisitsInfo()
        {
            var store = DynamicDataStoreFactory.Instance.GetStore(typeof(ProjectVisits));

            if (store == null)
            {
                DynamicDataStoreFactory.Instance.CreateStore(typeof(ProjectVisits));
                return new List<ProjectVisits>();
            }

            return store.LoadAll<ProjectVisits>().ToList();

        }

 

public class ProjectVisits:IDynamicData
    {
        public string LinkURL { get; set; }
        public int NumberOfVisits { get; set; }
        public int PageID { get; set; }


        public EPiServer.Data.Identity Id
        {
            get;
            set;
        }
    }

The exception occurs specifically when I try to create the store. Any ideas?
Thanks!

/Kenia

#54549
Oct 20, 2011 11:40
Vote:
 

The storeName will use the full namespace of your ProjectVisits class. Does this contain any special characters? I think that only characters a-z, 0-9, '.', and '_' are allowed for security reasons

#54551
Oct 20, 2011 13:10
Vote:
 

Guess ProjectVisits is a class defined inside another class. That will mess up the namespace with _

just move the class outside and dont have any spesial characters in the namespace

#54556
Oct 20, 2011 14:04
Vote:
 

Hello and thanks for your reply! I had invalid characters in the namespace, so I provided a name for the store and the problem was solved.

#54561
Oct 20, 2011 15:04
This topic was created over six months ago and has been resolved. If you have a similar question, please create a new topic and refer to this one.
* You are NOT allowed to include any hyperlinks in the post because your account hasn't associated to your company. User profile should be updated.