VulnerabilityController.cs

using System;
using System.Collections.Generic;
using System.Configuration;
using System.Data.SqlClient;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using Microsoft.AspNet.Identity;
using SecurityTestingDemo.Models;

namespace SecurityTestingDemo.Controllers
{
    public class VulnerabilityController : Controller
    {
        private readonly List<Employee> _users = new List<Employee>
        {
            new Employee
            {
                DateOfBirth = new DateTime(1971,1,1),
                Name = "User 1",
                PhoneNumber = "+33554468942"
            },
            new Employee
            {
                DateOfBirth = new DateTime(1982,2,2),
                Name = "User 2",
                PhoneNumber = "+43554488944"
            },
            new Employee
            {
                DateOfBirth = new DateTime(1993,3,3),
                Name = "User 3",
                PhoneNumber = "+49554486844"
            }
        };
        // GET: Vulnerability
        public ActionResult Index()
        {
            return View();
        }

        [ValidateInput(false)]
        public ActionResult ReflectedXss(string name)
        {
            var requestedName = name ?? "-name-";
            return View("ReflectedXss", model: requestedName);
        }

        public ActionResult SqlInjection(string name)
        {
            var userId = Guid.Empty;
            Guid.TryParse(HttpContext.User?.Identity?.GetUserId(), out userId);
            var connectionString = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString;
            using (var connection = new SqlConnection(connectionString))
            {

                var query = $"SELECT Id, Name, PhoneNumber, DateOfBirth FROM Employees WHERE SupervisorId='{userId}'";

                if (name != null)
                {
                    query += $" AND name = '{name}'";
                }

                var cmd = connection.CreateCommand();
                cmd.CommandText = query;

                connection.Open();

                using (var reader = cmd.ExecuteReader())
                {
                    var results = new List<Employee>();

                    while (reader.Read())
                    {
                        results.Add(new Employee
                        {
                            Id = reader.GetGuid(0),
                            Name = reader.GetString(1),
                            PhoneNumber = reader.GetString(2),
                            DateOfBirth = reader.GetDateTime(3)
                        });
                    }

                    return View("SqlInjection", model: results);
                }
            }
        }
    }
}