有效防止SQL注入漏洞详细说明
1.如果动态构造的sql语句中包含参数,请必须对参数做如下操作
a.将'(单引号)替换成''(两个单引号)
b.将--(注释符)替换掉
c.将参数加入语句时,一定要在前后各加上引号,如:'select * from table where id='''+@id+''''这样的加法
2.如果动态构造的sql语句中包含表参数,请勿必给表加上[](中括号),如:'select * from ['+@tab+']'这样的做法
3..避免动态sql语句:尤其是从ie客户端获取查询、修改、删除条件的字段最容易被注入,例如上述从客户端获取personid,为了开发方便,直接把从客户端获取的persongid作为sql语句的条件,却没有对personid作必要的检查,所以在开发时执行sql语句时最好使用preparedstatement类。
4. 验证数据:在客户端ie使用网页特效验证用户输入数据的合法性作用其实不是很大,一定要在获取客户端数据之后,对数据进行严格的验证,开发人员不要假想用户只会输入合法的数据。确保在应用程序中检查分号、引号、括号、sql关键字等。可以使用正则表达式来进行复杂的模式匹配,运用它可以达到良好的效果。
×××网站地址薄查看程序需要传递一个personid,personid可以通过url参数传递,由于地址本查看程序直接获取personid,没有做任何数据合法性验证,而且personid是字符串变量,获取personid的代码如下:
if (getparameter(req,"personid")!=null){
personid=getparameter(req,"personid").trim();
}else{
personid="";
}
该程序中组合成的动态sql语句如下:
personsql="select * from 表名 where userid="+long.tostring(userid)+" and addrcontactid="+personid;
由于程序没有检查personid是否是整数,所以攻击者随便给personid赋一个值,即可继续运行后续的程序逻辑,如果攻击者输入如下网址:
http://www.----------------------?personid=6414 or 2=2
组合成的sql语句如下:
select * from 表名where userid=1433620 and addrcontactid=6414 or 2=2
防范方法
sql注入漏洞可谓是“千里之堤,溃于蚁穴”,这种漏洞在网上极为普遍,通常是由于程序员对注入不了解,或者程序过滤不严格,或者某个参数忘记检查导致。在这里,我给大家一个函数,代替asp教程中的request函数,可以对一切的sql注入say no,函数如下:
function saferequest(paraname,paratype)
'--- 传入参数 ---
'paraname:参数名称-字符型
'paratype:参数类型-数字型(1表示以上参数是数字,0表示以上参数为字符)dim paravalue
paravalue=request(paraname)
if paratype=1 then
if not isnumeric(paravalue) then
response.write "参数" & paraname & "必须为数字型!"
response.end
end if
else
paravalue=replace(paravalue,"'","''")
end if
saferequest=paravalue
end function
上面函数应用
对于int型的参数,如文章的id等,可以先判断是不是整数。
id =trim(request("id"))
if id"" then
if not isnumeric(id) then
response.write"请提供数字型参数"
response.end
end if
id = clng(id)
else
response.write"请输入参数id"
response.end
end if

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

HQL and SQL are compared in the Hibernate framework: HQL (1. Object-oriented syntax, 2. Database-independent queries, 3. Type safety), while SQL directly operates the database (1. Database-independent standards, 2. Complex executable queries and data manipulation).

When creating a virtual machine, you will be asked to select a disk type, you can select fixed disk or dynamic disk. What if you choose fixed disks and later realize you need dynamic disks, or vice versa? Good! You can convert one to the other. In this post, we will see how to convert VirtualBox fixed disk to dynamic disk and vice versa. A dynamic disk is a virtual hard disk that initially has a small size and grows in size as you store data in the virtual machine. Dynamic disks are very efficient at saving storage space because they only take up as much host storage space as needed. However, as disk capacity expands, your computer's performance may be slightly affected. Fixed disks and dynamic disks are commonly used in virtual machines

"Usage of Division Operation in OracleSQL" In OracleSQL, division operation is one of the common mathematical operations. During data query and processing, division operations can help us calculate the ratio between fields or derive the logical relationship between specific values. This article will introduce the usage of division operation in OracleSQL and provide specific code examples. 1. Two ways of division operations in OracleSQL In OracleSQL, division operations can be performed in two different ways.

Oracle and DB2 are two commonly used relational database management systems, each of which has its own unique SQL syntax and characteristics. This article will compare and differ between the SQL syntax of Oracle and DB2, and provide specific code examples. Database connection In Oracle, use the following statement to connect to the database: CONNECTusername/password@database. In DB2, the statement to connect to the database is as follows: CONNECTTOdataba

Interpretation of MyBatis dynamic SQL tags: Detailed explanation of Set tag usage MyBatis is an excellent persistence layer framework. It provides a wealth of dynamic SQL tags and can flexibly construct database operation statements. Among them, the Set tag is used to generate the SET clause in the UPDATE statement, which is very commonly used in update operations. This article will explain in detail the usage of the Set tag in MyBatis and demonstrate its functionality through specific code examples. What is Set tag Set tag is used in MyBati

Solution: 1. Check whether the logged-in user has sufficient permissions to access or operate the database, and ensure that the user has the correct permissions; 2. Check whether the account of the SQL Server service has permission to access the specified file or folder, and ensure that the account Have sufficient permissions to read and write the file or folder; 3. Check whether the specified database file has been opened or locked by other processes, try to close or release the file, and rerun the query; 4. Try as administrator Run Management Studio as etc.

C++ parameter type safety checking ensures that functions only accept values of expected types through compile-time checks, run-time checks, and static assertions, preventing unexpected behavior and program crashes: Compile-time type checking: The compiler checks type compatibility. Runtime type checking: Use dynamic_cast to check type compatibility, and throw an exception if there is no match. Static assertion: Assert type conditions at compile time.

Database technology competition: What are the differences between Oracle and SQL? In the database field, Oracle and SQL Server are two highly respected relational database management systems. Although they both belong to the category of relational databases, there are many differences between them. In this article, we will delve into the differences between Oracle and SQL Server, as well as their features and advantages in practical applications. First of all, there are differences in syntax between Oracle and SQL Server.
