A further discussion on ASP preventing SQL injection Vulnerability

Source: Internet
Author: User
Tags functions how to prevent sql injection sql injection sql injection prevention
Problems on ASP preventing SQL injection vulnerabilities


/**
Author: Ci Qin Qiang
Email:cqq1978@gmail.com
*/


There seems to be nothing left to say about the SQL injection prevention of ASP. In my ASP's project,

are written by their own functions to handle the data submitted by the client, my blog inside also posted this function.


Specific reference to Http://blog.csdn.net/cqq/archive/2004/09/23/113786.aspx



However, a lot of people have gone into a misunderstanding from friends ' messages and other online functions on how to prevent SQL injection.

SQL injection is very harmful, for example, for SQL Server, you can create, delete databases, execute system commands, and so on, such as

drop table Tbl_name, execute Master.dbo.xp_cmdshell "command"

So many people write the function is desperately to filter these potentially harmful keywords, such as drop, semicolon, and,exe,mid and so on, listed

A whole bunch.



In fact, do not have to be so cumbersome, do not have to complicate the simple things.

For filtering, the ASP, as long as the character and the number of separate processing can be,



Character type, converts single quotes into two single quotes strtmp = Replace (Trim (str), "'", "" ")

Digital, to determine whether it can be converted to a digital type, using the IsNumeric function




What is now said on the Internet to be able to bypass single quotes is actually for numeric types

If there is a way to bypass the character type that filters the single quotes, it's no fun ...



Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.