This gives malicious students the opportunity to use the input of some strange query string, splicing into a specific SQL statement, you can achieve the purpose of injection. Not only can you get important information about the database, you can even delete the entire table if the permissions are not set properly. As a result, SQL injection vulnerabilities are fairly serious. Found that I have just learned to write the site is also by splicing the SQL statement eat drops ...
Example
To better learn and understand SQL injection methods, do a sample Web page with the following interface:
Click on the code to log on to this block, note that line 5th, we use the concatenation of SQL statements:
Copy Code code as follows:
private void Login ()
{
string uname = Tbname.text;
string pwd = Tbpassword.text;
String SQLCMD = "SELECT * from [Users] where UserName = '" + uname + "'";
String sqlcmdrep = Sqlcmd.replace ("Users", "XXX"). Replace ("UserName", "XXX");
Lbsql.text = Sqlcmdrep;
Try
{
DataTable dt = datasqlserver.getdatatable (SQLCMD);
Gvresult.datasource = DT;
Gvresult.databind ();
if (dt. Rows.Count = = 1 && pwd = = dt. rows[0]["Password"]. ToString ())
{
Lbres.text = dt. rows[0]["UserName"] + "Login success!";
}
else if (dt. Rows.Count = 0)
{
Lbres.text = uname + "Not exist!";
}
Else
{
Lbres.text = "Login fail!";
}
}
catch (Exception ex)
{
Lbres.text = "Error:" + ex. message;
}
}
current 1/3 page
1 23 Next read the full text
