I found a lot of weird string in my database, someone trying to get into my site? I found a lot of weird string in my database, someone trying to get into my site? sql-server sql-server

I found a lot of weird string in my database, someone trying to get into my site?


It looks like someone was trying to get in with SQL injection. As long as your using input validation and escaping the input you should be ok on this front. You might want to look into other ways of hardening your site, though.

Here's a resource for protecting against SQL Injection in ASP.NET.And another resource for general website hardening. Hope it helps!


There doesn't appear to be anything you need to overly worry about, people will always try and exploit input forms to see if they are able to get any data back. It looks like you've done all the basic and standard methods to prevent them from getting anywhere. There are a couple of methods which you can use to stop this occurring as much.

Request Throttling

This is pretty simple you are literally just limiting the number of times a single user is able to submit data in the contact form over a period of time. There are a number of articles on this and many answers scattered over SO. The easiest method is to use the HttpRuntime cache and simply store the users IP address with an expiration time. Then on each request check the cache to make sure their IP address isn't stored in it.

IP Banning

This method is similar to the one above but a bit more long term. The easiest way is to keep track of users who are submitting multiple inquiries and if they send over 30 in the space of 10 minutes or so add their IP address into a table which you can check against and prevent them from submitting anymore inquires.

You could even use the two in conjunction.


Yes, someone is trying to hack your website. It looks like it might be a script.

I would suggest using a security scanning tool to see if there are any obvious holes in your application. OWASP has a list of useful tools.