Sanitize User Input for C# Applications

Here are the initial instructions and explanation of the lab environment. Read this while your environment is busy creating itself from nothing. Yes, this violates physics; we know. How fun!

You'll review core web vulnerabilities: SQL Injection, XSS, and CSRF. Learn how untrusted input, unencoded output, and missing request validation expose risks—and how to mitigate them in ASP.NET Core MVC apps.

You'll analyze a C# console app with a SQL injection vulnerability caused by string concatenation. You'll then refactor it using parameterized queries with SqlCommand and test it with both valid and malicious inputs to confirm the fix.

You'll build a Razor view in ASP.NET Core MVC that initially renders unencoded input, exposing an XSS risk. You'll then apply WebUtility.HtmlEncode and test with script payloads to confirm the secure version renders the input as harmless text.

You'll create an ASP.NET Core MVC app with a state-changing form that lacks CSRF protection. You'll then add anti-forgery tokens and apply the ValidateAntiForgeryToken attribute to secure it and ensure POST requests come from trusted sources.

In this challenge, you will answer some assessment questions that will test your understanding of the concepts you learned throughout this lab.