I have a mobile app where I collect some data from user input, encrypt that, and send it to a web service (written in VB.Net) where it is decrypted and handled.

I am trying to understand SQL Injection exposure. Both from INSERT and SELECT which is what the user is accessing.

My concern is that I might not be handling the user supplied data correctly to protect against SQL Injection within the web service.

Would appreciate if you could comment on the following items and let me know if I am making a mistake in these blocks of code that would result in Injection issues.

Thanks

A) --------------------------------

Dim insertSql As String = "INSERT INTO tblQRVerify (UID,passedUID,GenPhoneUID,IMEI,iPhoneUID,Lat,Lng,ScannedLat,ScannedLng,QRVerifyDate,phoneType) VALUES('" & GenUIDVerify & "','" & passedGenUID & "','" & OrgGenPhoneUID & "','" & OrgIMEI & "','" & iPhoneUID & "','" & Latitude & "','" & Longitude & "','" & SLatitude & "', '" & SLongitude & "','" & QRVerifyDate & "','" & phoneType & "')"    

m1Command.Connection = mSqlconnection
m1Command.CommandType = CommandType.Text
m1Command.CommandText = insertSql

m1Command.Parameters.Add(New SqlParameter("@UID", GenUIDVerify))
m1Command.Parameters.Add(New SqlParameter("@passedUID", passedGenUID))
m1Command.Parameters.Add(New SqlParameter("@GenPhoneUID", OrgGenPhoneUID))
m1Command.Parameters.Add(New SqlParameter("@IMEI", OrgIMEI))
m1Command.Parameters.Add(New SqlParameter("@iPhoneUID", iPhoneUID))
m1Command.Parameters.Add(New SqlParameter("@lat", Latitude))
m1Command.Parameters.Add(New SqlParameter("@lng", Longitude))
m1Command.Parameters.Add(New SqlParameter("@ScannedLat", SLatitude))
m1Command.Parameters.Add(New SqlParameter("@ScannedLng", SLongitude))
m1Command.Parameters.Add(New SqlParameter("@QRGenDate", QRVerifyDate))
m1Command.Parameters.Add(New SqlParameter("@phoneType", phoneType))

 _Logger.Info("ready to insert")
 'save parent record
mReturn = m1Command.ExecuteScalar()
_Logger.Info("QRVerify Inserted")

Return OrgGenPhoneUID

Catch ex As Exception
      _Logger.Error("Error in db.QRVerify - Inserting tblQRVerify  :" & ex.Message)

Finally
     m1Command.Dispose()

End Try

Return "UIDFound - False"

Below I am not sure if I am using the paramatized approach correctly.

B) --------------------

        ' Public Function AuthenticateUser(ByVal vUserName As String, ByVal vPassword As String) As Long
        '     Try
        '         Dim mSql As String = "Select id from tblUsers where user_id='" & vUserName & "' and user_pass='" & vPassword & "'"
        '         AuthenticateUser = ExecuteLongScalar(mSql)
        '     Catch ex As Exception
        '         ' Throw New Exception("AuthenticateUser : " & ex.Message)  
        '         _Logger.Error("Database.AuthenticateUser : " & ex.Message)
        '     End Try
        ' End Function


        Public Function AuthenticateUser(ByVal vUserName As String, ByVal vPassword As String) As Long

            Dim mCommand As SqlCommand = New SqlCommand()
            mCommand.Connection = mSqlconnection
            mCommand.CommandType = CommandType.Text

            Try
                Dim mSql As String = "Select id from tblUsers where user_id= ? and user_pass= ?"      ' was this    '" & vUserName & "' and user_pass='" & vPassword & "'"

                mCommand.Parameters.Add(New SqlParameter("user_id", vUserName))
                mCommand.Parameters.Add(New SqlParameter("user_pass", vPassword))

                AuthenticateUser = ExecuteLongScalar(mSql)

            Catch ex As Exception
                _Logger.Error("Database.AuthenticateUser : " & ex.Message)

            End Try

        End Function

I think the following is just outright wrong ?

C ---------------------------
    Try
       Dim mCommand As SqlCommand = New SqlCommand()
       mCommand.Connection = mSqlconnection
       mCommand.CommandType = CommandType.Text

       Dim sql As String = "select * from tblmobileRef where Len(mobileNumber)> 0  "

       If (Not String.IsNullOrEmpty(mobileNumber)Then
          _Logger.Info("Pick record by mobileNo :" & (mobileNumber)

          sql = sql & " and mobileNumber=@mobileNumber"
          mCommand.CommandText = sql
          mCommand.Parameters.Add(New SqlParameter("@mobileNumber", mobileNo))
       end if

       Dim encoding As System.Text.Encoding = New System.Text.UnicodeEncoding()
       Dim reader As SqlDataReader

       reader = mCommand.ExecuteReader()

This following code I found on the web. Is this correct ?
I don’t quite understand it, especially the SELECT @@IDENTITY

D) --------------------------

        Using con As New OleDb.OleDbConnection
            con.ConnectionString = finalConnString
            con.Open()
            Using cmd As New OleDb.OleDbCommand
                cmd.Connection = con
                cmd.CommandText = "INSERT INTO UsersTable (LastName, FirstName) VALUES (?, ?);"
                cmd.Parameters.AddWithValue("?", Me.LastName.Text)
                cmd.Parameters.AddWithValue("?", Me.FirstName.Text)
                cmd.ExecuteNonQuery()
            End Using
            Using cmd As New OleDb.OleDbCommand
                cmd.Connection = con
                cmd.CommandText = "SELECT @@IDENTITY"
                newID = cmd.ExecuteScalar()
            End Using
            con.Close()
        End Using