namespace QueryStringEncryption
{
public class CustomQueryStringModule:IHttpModule
{

#region IHttpModule Members

public void Dispose()
{
// Nothing to dispose
}

public void Init(HttpApplication context)
{
context.BeginRequest += new EventHandler(context_BeginRequest);
}

#endregion

private const string PARAMETER_NAME = “enc=”;
private const string ENCRYPTION_KEY = “key”;

void context_BeginRequest(object sender, EventArgs e)
{
HttpContext context = HttpContext.Current;
if (context.Request.Url.OriginalString.Contains(“aspx”) && context.Request.RawUrl.Contains(“?”))
{
string query = ExtractQuery(context.Request.RawUrl);
string path = GetVirtualPath();

if (query.StartsWith(PARAMETER_NAME, StringComparison.OrdinalIgnoreCase))
{
// Decrypts the query string and rewrites the path.
string rawQuery = query.Replace(PARAMETER_NAME, string.Empty);
string decryptedQuery = Decrypt(rawQuery);
context.RewritePath(path, string.Empty, decryptedQuery);
}
else if (context.Request.HttpMethod == “GET”)
{
// Encrypt the query string and redirects to the encrypted URL.
// Remove if you don’t want all query strings to be encrypted automatically.
string encryptedQuery = Encrypt(query);
context.Response.Redirect(path + encryptedQuery);
}
}
}

///
/// Parses the current URL and extracts the virtual path without query string.
///
/// The virtual path of the current URL.
private static string GetVirtualPath()
{
string path = HttpContext.Current.Request.RawUrl;
path = path.Substring(0, path.IndexOf(“?”));
path = path.Substring(path.LastIndexOf(“/”) + 1);
return path;
}

///
/// Parses a URL and returns the query string.
///
/// The URL to parse.
/// The query string without the question mark.
private static string ExtractQuery(string url)
{
int index = url.IndexOf(“?”) + 1;
return url.Substring(index);
}

#region Encryption/decryption

///
/// The salt value used to strengthen the encryption.
///
private readonly static byte[] SALT = Encoding.ASCII.GetBytes(ENCRYPTION_KEY.Length.ToString());

///
/// Encrypts any string using the Rijndael algorithm.
///
/// The string to encrypt.
/// A Base64 encrypted string.
public static string Encrypt(string inputText)
{
RijndaelManaged rijndaelCipher = new RijndaelManaged();
byte[] plainText = Encoding.Unicode.GetBytes(inputText);
PasswordDeriveBytes SecretKey = new PasswordDeriveBytes(ENCRYPTION_KEY, SALT);

using (ICryptoTransform encryptor = rijndaelCipher.CreateEncryptor(SecretKey.GetBytes(32), SecretKey.GetBytes(16)))
{
using (MemoryStream memoryStream = new MemoryStream())
{
using (CryptoStream cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write))
{
cryptoStream.Write(plainText, 0, plainText.Length);
cryptoStream.FlushFinalBlock();
return “?” + PARAMETER_NAME + Convert.ToBase64String(memoryStream.ToArray());
}
}
}
}

///
/// Decrypts a previously encrypted string.
///
/// The encrypted string to decrypt.
/// A decrypted string.
public static string Decrypt(string inputText)
{
RijndaelManaged rijndaelCipher = new RijndaelManaged();
byte[] encryptedData = Convert.FromBase64String(inputText);
PasswordDeriveBytes secretKey = new PasswordDeriveBytes(ENCRYPTION_KEY, SALT);

using (ICryptoTransform decryptor = rijndaelCipher.CreateDecryptor(secretKey.GetBytes(32), secretKey.GetBytes(16)))
{
using (MemoryStream memoryStream = new MemoryStream(encryptedData))
{
using (CryptoStream cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read))
{
byte[] plainText = new byte[encryptedData.Length];
int decryptedCount = cryptoStream.Read(plainText, 0, plainText.Length);
return Encoding.Unicode.GetString(plainText, 0, decryptedCount);
}
}
}
}

#endregion
}
}

Web.Config Settings:

1. Create SP
2. Use .NET code to call the SP for each row in the grid.

Example: Create Table Employee(FirstName varchar(50), LastName varchar(50), Phone varchar(50))

Create Procedure InsertEmployee
@FirstName varchar(50),
@LastName varchar(50),
@Phone varchar(50)
AS
INSERT INTO Employee (FirstName,LastName,Phone)
VALUES (@FirstName,@LastName,@Phone)
GO

.NET Side of Code:

using (SqlConnection conn = new SqlConnection(“…”))
{
SqlCommand cmd = conn.CreateCommand();
cmd.CommandType = System.Data.CommandType.StoredProcedure;
cmd.CommandText = “dbo.InsertEmployee”;
cmd.Parameters.AddWithValue(“@FirstName”, (string)row["Name"]);
cmd.Parameters.AddWithValue(“@LastName”, (string)row["City"]);
cmd.Parameters.AddWithValue(“@Phone”, (string)row["Phone"]);
conn.Open();
cmd.ExecuteNonQuery();
}

Using the new Table Value Parameter feature in SQL 2008, we can create a SP that takes a Table as the parameter.

1. Create a new User-Defined Table Type as below

Create type MyTableType As Table
(
FirstName varchar(50),
LastName varchar(50),
Phone varchar(50)
)

2. Create a SP that takes the above UDT as a parameter
Create Procedure InsertEmployeesMany
(
@MyTableType MyTableType readonly
)

AS

INSERT INTO Employee (FirstName,LastName,Phone)
SELECT FirstName,LastName,Phone
FROM @MyTableType;
3. Executing the Above SP using Script /.NET Code

T-SQL:
Declare @Employee_temp MyTableType
INSERT INTO @Employee_temp VALUES(“FirstName1″,”LastName1″,”234567″)
INSERT INTO @Employee_temp VALUES(“FirstName2″,”LastName2″,”222222″)

Execute InsertEmployeesMany @Employee_temp

.NET Code:

// Create a data table, and provide its structure
DataTable employeeTable = new DataTable();
employeeTable .Columns.Add(“FirstName”, typeof(string));
employeeTable .Columns.Add(“LastName”, typeof(string));
employeeTable .Columns.Add(“Phone”, typeof(string));

// Fill with rows
employeeTable .Rows.Add(“FirstName1″,”LastName1″,”234567″);
employeeTable .Rows.Add(“FirstName2″,”LastName2″,”222222″);

//Invoke the SP
using (SqlConnection conn = new SqlConnection(“…”))
{
SqlCommand cmd = conn.CreateCommand();
cmd.CommandType = System.Data.CommandType.StoredProcedure;
cmd.CommandText = “dbo.InsertEmployeesMany”;
SqlParameter param = cmd.Parameters.AddWithValue(“@MyTableType “, employeeTable );
conn.Open();
cmd.ExecuteNonQuery();
}

SELECT MyDate = convert(varchar(10), @MyDate, 101) +
stuff( right( convert( varchar(26), @MyDate, 109 ), 15 ), 7, 7, ‘ ‘ )

SET @MyResult = convert(varchar(10), @MyDate, 101) +
stuff( right( convert( varchar(26), @MyDate, 109 ), 15 ), 7, 7, ‘ ‘ )

SELECT LTRIM(RTRIM(SUBSTRING(@MyResult,11,LEN(@MyResult)-10)))

I would like to add to the list…..