参数化查询与输入验证：eb开发必学的SQL注入防御技巧-嘻道妙招

鍏勫紵浠紝浣犱滑鏈夋病鏈夐亣鍒拌繃杩欑鍦烘櫙锛熺敤鎴峰湪鍓嶇杈撳叆涓敤鎴峰悕锛岀粨鏋滆繖璐у伔鍋峰浜嗘' OR 1=1 --杩涙潵锛岀洿鎺ユ妸浣犳暟鎹簱鑰佸簳閮芥巰浜嗐€傝繖鏃跺€欌€?strong>鈥嬪弬鏁板寲鏌ヨ鈥?/strong>鈥嬪氨鏄綘鐨勬晳鍛界ɑ鑽夛紒

涓句釜鏍楀瓙馃尠锛氬亣璁炬湁涓櫥褰曞姛鑳斤紝鏂版墜鍙兘浼氭妸鐢ㄦ埛杈撳叆鐩存帴鎷兼帴鍒癝QL璇彞閲岋細

sql澶嶅埗"SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'"

杩欏啓娉曠畝鐩存槸鍦ㄥ榛戝璇?娆㈣繋鍏変复"锛佽€岀敤鍙傛暟鍖栨煡璇㈢殑璇濓紝浠ｇ爜灏卞彉鎴愪簡锛?/p>

python澶嶅埗cursor.execute("SELECT * FROM users WHERE username=%s AND password=%s", (username, password))

鐪嬪埌娌★紵鐢ㄦ埛杈撳叆琚 杩?s杩欎釜"闅旂鑸?閲岋紝灏辩畻杈撳叆閲屾湁濡栭瓟楝兼€篃缈讳笉璧锋氮php.cn銆傚氨鍍忕粰SQL璇彞绌夸簡灞傞槻寮硅。锛岀浣犺緭鍏ュ暐閮界粰鎴戣€佽€佸疄瀹炲綋瀛楃涓插鐞嗭紒

浜屻€佽緭鍏ラ獙璇侊細瀹佸彲閿欐潃涓€鍗冿紝涓嶅彲鏀捐繃涓€涓壒娈婂瓧绗?/h3>

寰堝灏忕櫧瑙夊緱鍙傛暟鍖栨煡璇㈠氨鑳介珮鏋曟棤蹇т簡锛熷浘鏍峰浘妫牬锛佲€?strong>鈥嬭緭鍏ラ獙璇佲€?/strong>鈥嬫墠鏄湡姝ｇ殑瀹堥棬鍛樸€傚ソ姣斾綘鍘诲搴楋紝淇濆畨涓嶄粎瑕佹煡韬唤璇侊紙鍙傛暟鍖栵級锛岃繕寰楃敤閲戝睘鎺㈡祴鍣ㄦ壂浣犲叏韬紙杈撳叆楠岃瘉锛夈€?/p>

杩欓噷鏁欏ぇ瀹朵袱涓粷鎷涳細

涓句釜瀹炴垬妗堜緥馃摑锛氭煇鐢靛晢缃戠珯鐨勫晢鍝佹悳绱㈠姛鑳斤紝鍘熸湰鐩存帴鎷兼帴鐢ㄦ埛杈撳叆锛?/p>

sql澶嶅埗"SELECT * FROM products WHERE name LIKE '%" + keyword + "%'"

缁撴灉榛戝杈撳叆%' UNION SELECT username,password FROM users --锛岀洿鎺ョ洍璧扮敤鎴锋暟鎹€傚悗鏉ヤ粬浠仛浜嗕笁浠朵簨锛?/p>

鐜板湪鏈変釜鐏甸瓊鎷烽棶锛氱敤鈥?strong>鈥嬪瓨鍌ㄨ繃绋嬧€?/strong>鈥嬭繕鏄€?strong>鈥婳RM妗嗘灦鈥?/strong>鈥嬫洿瀹夊叏锛熷挶浠仛涓姣旓細

闃插尽鏂瑰紡	浼樼偣	缂虹偣	閫傜敤鍦烘櫙
瀛樺偍杩囩▼	棰勭紪璇?鏉冮檺闅旂	缁存姢鎴愭湰楂?/td>	澶嶆潅涓氬姟閫昏緫
ORM妗嗘灦	鑷姩鍙傛暟鍖?/td>	澶嶆潅鏌ヨ鎬ц兘宸?/td>	蹇€熷紑鍙戦」鐩?/td>
鍘熺敓SQL+鍙傛暟鍖?/td>	鐏垫椿鎬у己	瀹规槗鎵嬫粦鍑洪敊	绠€鍗曟煡璇㈠満鏅?/td>

涓汉鏇存帹鑽愭柊鎵嬬敤ORM妗嗘灦锛屽儚Django鐨凮RM銆丼pring Data JPA杩欎簺锛屽畠浠細鑷姩甯綘鍋氬弬鏁板寲澶勭悊銆備笉杩囪娉ㄦ剰鍒敤鍘熺敓SQL鏌ヨ杩欎釜鍚庨棬鍔熻兘锛屽惁鍒欏墠鍔熷敖寮?span>鎼滅嫍鐧剧

鍥涖€侀偅浜涘勾鎴戜滑韪╄繃鐨勫潙锛氱湡瀹炴渚嬪垎鏋?/h3>

璇翠釜琛€娉暀璁煉旓細2018骞存煇鏀垮簻绯荤粺琚粦锛屽氨鏄洜涓哄紑鍙戝皬鍝ュ啓浜嗚繖鏍风殑浠ｇ爜锛?/p>

java澶嶅埗String sql = "UPDATE user SET role='admin' WHERE id=" + request.getParameter("id");

榛戝鐩存帴鎶奿d鍙傛暟鏀规垚0; DROP TABLE audit_log --锛屼笉浠呮彁鏉冩垚鍔燂紝杩樻妸瀹¤鏃ュ織琛ㄧ粰鎵簡...鍚庢潵浠栦滑鍋氫簡涓変欢浜嬶細

鍦ㄥ畨鍏ㄧ晫娣蜂簡杩欎箞澶氬勾锛屾垜鍙戠幇涓湁瓒ｇ幇璞★細80%鐨凷QL娉ㄥ叆婕忔礊閮藉嚭鑷?鎴戣寰楄繖娈典唬鐮佹病闂"鐨勮嚜淇°€傚缓璁ぇ瀹跺吇鎴愪笁涓範鎯細

鏈€鍚庨€佸ぇ瀹朵竴鍙ヨ瘽锛氣€?strong>鈥嬪畨鍏ㄦ病鏈夐摱寮癸紝浣嗘瘡涓槻寰℃帾鏂介兘鏄粦瀹㈣矾涓婄殑缁婅剼鐭斥€?/strong>鈥嬨€備笌鍏剁瓑婕忔礊琚埄鐢ㄥ悗鍔犵彮鎿﹀眮鑲★紝涓嶅鐜板湪灏辨妸杩欎簺闃插尽鎶€宸х敤璧锋潵锛?/p>

本文由嘻道妙招独家原创，未经允许，严禁转载

参数化查询与输入验证：eb开发必学的SQL注入防御技巧