<web Safety Design Road >

NET code security Interface Vulnerability Prevention and program optimization

First, the source of SQL injection attacks

1. Filter or transfer dangerous characters

2. Use the SqlParameter class: the. NET Framework has a collection type called SqlParameter, which provides type and length checking, and automatically escapes user input.

3. Restrict input with regular expressions, for example, you can restrict input with a class regex from the System.Text.RegularExpressions namespace.

4. Use least Privilege

5. Reject one of the attack signatures:

Depending on the behavior of your application, you can deny access to data that may be dangerous. Keywords that filter for dangerous SQL commands, such as Drop,delete,insert or update.

6. Encryption processing

The System.webSecurity.Forms Authenatication class has a hashpasswordforstoringconfigfile that is suitable for processing input data.

7. Handling errors on the server

If you hide database behavior in try and Catch statements and correctly handle errors on the server side, you can avoid attackers gathering information. The details of the errors that are recorded in the Catch statement will help you learn about the attacks and attempts to attack them.

<web Safety Design Road >