What do you know about SQL injection?

believe that in the acceptance room or student fee system, many of the master in the beginning of the landing interface first inexplicably wrote a string of things. And then they landed in the strange wonder. Did not tell them the user name, did not tell them any password. What's going on? Master in the input when I also like a fool on the side of the shouting: Eh, not right, you lose all wrong. For my performance at the time, I felt all. It's really ... Can't bear to recall ... Fortunately, with the master of those things can not be logged in. I secretly happy, feel good strong. But I didn't understand what he said. Later, in the acceptance of the software documentation, the master mentioned the matter again. Probably told me a bit, I just understand, originally, this is called "SQL injection". Listen, it's pretty big. But how much do you know about SQL injection?

"Concept" is called SQL injection, that is, by inserting a SQL command into a Web form to submit or enter a domain name or a page request query string, and eventually to deceive the server to execute a malicious SQL command, For example, many of the previous film and television sites leaked VIP membership password is mostly through the Web form to submit query characters, such forms are particularly vulnerable to SQL injection attacks .

"Principle" take our engine room example to say it. In the login interface we let the user enter the login name and password, right, only access to our system. So our interface is like this.

So, when we write code, we write this txtsql = "SELECT * from User_info where userid= '" & txtName.Text & "' and Val (MRC. Fields (1)) = "' & Val (txtpassword.text) & '" Obviously, if the person with the login permission enters the correct login name and the correct password, the system will be able to find the corresponding data from the database. and allow the login system, on the contrary, if you enter a user name or password one of the wrong, then can not log in, in theory, it is true, but for the SQL injection of a vulnerable site is dangerous. As long as those hackers design a special string, it is likely to be hacked to obtain the corresponding user information. What a horrible thing it is. But how do those hackers design special characters? Also use this example, for example, I entered in the user name: ' or 1=1 # behind the password to enter freely, you can enter the system. Let's take a look at the analysis.

      When we enter: ' or 1=1 #    , the code we write in the background becomes the select  * from user_info where UserID = ' or 1=1 # and Val (Mrc.fields (1)) = ' "& Val (txtpassword.text) & '"  

Please pay attention to or behind The 1=1 is always set up, that is to say, user name This certainly no problem can be cracked. But someone asked, there are restrictions on the password. Please note that #是SQL中的注释符, that is, #后边的内容都被注释掉了, and cannot be executed, so this code can be simplified to  select  * from user_info where UserID =" or 1=1, However, 1=1 is always true, that is, where clause   always holds. Therefore, this code can be simplified to select  * from User_info ...

    "Prevent SQL injection"

(1) Carefully detect the variable parameters submitted by the client. For numerical parameters, the general use of IsNumeric () function to determine whether it contains non-numeric characters, the character parameters, the need for single quotation marks, double quotes, "-", semicolons and so on to filter, it is best to determine the length of the user submitted parameters, where the illegal person by the program to give the wrong hint 。 Found client-submitted parameters include "exec, insert, select, Delete, from, update, Count, and, *,%, user, xp_cmdshell, add, Net, CHR, Mid, Master, Truncate, Char, declare, ASC, and so on characters commonly used for SQL injection, immediately stop executing the ASP and give a warning message or go to the error page. It is a good solution to check the legality of the submitted data before the server is formally processed. The server refuses to perform critical operations and processing until the client's input is confirmed as legitimate. Once a sensitive character or string is detected, operations against the database are aborted immediately.
(2) Discard dynamic SQL statements instead of using user stored procedures to access and manipulate the database. This requires that after the database is established, carefully consider the various operations that the Web program needs to perform on the database, establish a stored procedure for it, and then have the Web program call the stored procedure to complete the database operation. In this way, the data submitted by the user will not be used to generate dynamic SQL statements, but is actually passed to the stored procedure as parameters, thus effectively blocking the path of SQL injection.

"sum up" the heart of harm can not have, anti-human heart must not have ...

What do you know about SQL injection?