A further discussion on ASP preventing SQL injection Vulnerability
/**
Author: Ci Qin Qiang
Email:cqq1978@gmail.com
*/
There seems to be nothing left to say about the SQL injection prevention of ASP. In my ASP's project,
are written by their own functions to handle the data submitted by the client, my blog inside also posted this function.
Specific reference to Http://blog.111cn.net/cqq/archive/2004/09/23/113786.aspx
However, a lot of people have gone into a misunderstanding from friends ' messages and other online functions on how to prevent SQL injection.
SQL injection is very harmful, for example, for SQL Server, you can create, delete databases, execute system commands, and so on, such as
drop table Tbl_name, execute Master.dbo.xp_cmdshell "command"
So many people write the function is desperately to filter these potentially harmful keywords, such as drop, semicolon, and,exe,mid and so on, listed
A whole bunch.
In fact, do not have to be so cumbersome, do not have to complicate the simple things.
For filtering, the ASP, as long as the character and the number of separate processing can be,
Character type, converts single quotes into two single quotes strtmp = Replace (Trim (str), "'", "" ")
Digital, to determine whether it can be converted to a digital type, using the IsNumeric function
What is now said on the Internet to be able to bypass single quotes is actually for numeric types
If there is a way to bypass the character type that filters the single quotes, it's no fun ...
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.