Detailed explanation of effectively preventing SQL injection vulnerabilities_PHP tutorial

1. If the dynamically constructed sql statement contains parameters, please do the following operations on the parameters
a. Replace '(single quote) with ''(two single quote)
b. Replace -- (comment character) with
c. When adding parameters to a statement, be sure to add quotation marks before and after, such as: 'select * from table where id='''+@id+'''' such addition
2. If the dynamically constructed SQL statement contains table parameters, do not add [] (square brackets) to the table, such as: 'select * from ['+@tab+']'

3. Avoid dynamic sql statements: especially the fields that obtain query, modification, and deletion conditions from the IE client are most likely to be injected. For example, the above-mentioned personid is obtained from the client. For the convenience of development, the fields obtained from the client are directly persongid is used as a condition of the sql statement, but there is no necessary check for personid, so it is best to use the preparedstatement class when executing sql statements during development.

4. Verify data: Using web page special effects on the client IE to verify the legality of user input data is actually not very effective. After obtaining the client data, the data must be strictly verified. Developers should not assume that the user only Legal data will be entered. Make sure to check for semicolons, quotes, brackets, sql keywords, etc. in your application. Regular expressions can be used to perform complex pattern matching, and good results can be achieved by using them.

The ××× website address book viewing program needs to pass a personid, and the personid can be passed through the url parameter. Since the address book viewing program obtains the personid directly without any data legality verification, and the personid is a string variable, the code to obtain the personid is as follows:

if (getparameter(req,"personid")!=null){

personid=getparameter(req,"personid").trim();

}else{

personid="";

}

The dynamic sql statements combined in this program are as follows:

personsql="select * from table name where userid="+long.tostring(userid)+" and addrcontactid="+personid;

Since the program does not check whether the personid is an integer, the attacker can assign a value to the personid and continue to run the subsequent program logic. If the attacker enters the following URL:

http://www.----------------------?personid=6414 or 2=2

The sql statement composed of

is as follows:

select * from table name where userid=1433620 and addrcontactid=6414 or 2=2

Prevention methods

SQL injection vulnerabilities can be said to be "a dike of thousands of miles, but collapses in an ant nest". This kind of vulnerability is extremely common on the Internet. It is usually caused by programmers not understanding injection, or program filtering is not strict, or a certain parameter is forgotten to check. . Here, I will give you a function that replaces the request function in the ASP tutorial. It can say no to all SQL injections. The function is as follows:

function saferequest(paraname,paratype)
'--- Incoming parameters ---
'paraname: parameter name - character type
'paratype: parameter type - numeric type (1 indicates that the above parameters are numbers, 0 indicates that the above parameters are characters)

dim paravalue
​paravalue=request(paraname)
if paratype=1 then
​if not isnumeric(paravalue) then
　　response.write "Parameter" & paraname & "Must be numeric type!"
　　response.end
end if
else
paravalue=replace(paravalue,"'","''")
end if
saferequest=paravalue
end function

Application of the above function

For int type parameters, such as the id of an article, you can first determine whether it is an integer.

id =trim(request("id"))
if id"" then
if not isnumeric(id) then
Response.write"Please provide numeric parameters"
Response.end
end if
id = clng(id)
else
response.write"Please enter parameter id"
response.end
end if

http://www.bkjia.com/PHPjc/629725.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/629725.htmlTechArticle1. If the dynamically constructed sql statement contains parameters, please do the following operations on the parameters a. Replace '( Replace single quote) with '' (two single quotes) b. Replace -- (comment character) c. When adding parameters to the statement...