Three Steps to Block SQL Injection Vulnerabilities_PHP Tutorial

What is SQL injection?
Many website programs are written without judging the legality of user input data, causing security risks in the application. Users can submit a database query code (usually in the browser address bar, accessed through the normal www port), and obtain certain data they want to know based on the results returned by the program. This is the so-called SQL Injection, that is, SQL injection. .
Website nightmare - SQL injection
SQL injection modifies the website database through web pages. It is able to add users with administrator rights directly in the database, thereby ultimately gaining system administrator rights. Hackers can use the obtained administrator rights to arbitrarily obtain files on the website or add Trojan horses and various malicious programs to the web page, causing great harm to the website and the netizens who visit the website.
There is a wonderful way to defend against SQL injection
Step 1: Many novices download the SQL universal anti-injection system program from the Internet and use it in the header of the page that needs to prevent injection to prevent others from performing manual injection testing (Figure 1).

Figure 1
However, if you use SQL injection analyzer, you can easily skip the anti-injection system and automatically analyze its injection points (Figure 2). Then it only takes a few minutes for your administrator account and password to be analyzed (Figure 3).

Figure 2

Figure 3

Step 2: For injection analysis Through experiments, the author discovered a simple and effective prevention method. First we need to know how the SQL injection analyzer works. During the operation, I found that the software was not directed to the "admin" administrator account, but to the permissions (such as flag=1). In this way, no matter how your administrator account changes, you cannot escape detection.

Step 3: Since we can’t escape detection, we will create two accounts, one is a normal administrator account, and the other is an account to prevent injection. Why do we say this? The author thinks that if you find an account with the highest authority to create a false impression and attract detection by the software, and the content in this account is more than 1,000 Chinese characters, it will force the software to enter a full load state and even use resources when analyzing this account. Exhausted and crashed. Let's modify the database next.

1. Modify the table structure. Modify the data type of the administrator's account field, changing the text type to the maximum field of 255 (actually it is enough, if you want to make it larger, you can choose the note type), and set the password field in the same way.

　2. Modify the table. Set the account with administrator rights in ID1, and enter a large number of Chinese characters (preferably more than 100 characters).

http://www.bkjia.com/PHPjc/631114.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/631114.htmlTechArticleWhat is SQL injection? Many website programs are written without judging the legality of user input data, causing security risks in the application. Users can submit a database query...