Problems on ASP preventing SQL injection vulnerabilities
/**
Author: Ci Qin Qiang
Email:cqq1978@gmail.com
*/
There seems to be nothing left to say about the SQL injection prevention of ASP. In my ASP's project,
are written by their own functions to handle the data submitted by the client, my blog inside also posted this function.
Specific reference to Http://blog.csdn.net/cqq/archive/2004/09/23/113786.aspx
However, a lot of people have gone into a misunderstanding from friends ' messages and other online functions on how to prevent SQL injection.
SQL injection is very harmful, for example, for SQL Server, you can create, delete databases, execute system commands, and so on, such as
drop table Tbl_name, execute Master.dbo.xp_cmdshell "command"
So many people write the function is desperately to filter these potentially harmful keywords, such as drop, semicolon, and,exe,mid and so on, listed
A whole bunch.
In fact, do not have to be so cumbersome, do not have to complicate the simple things.
For filtering, the ASP, as long as the character and the number of separate processing can be,
Character type, converts single quotes into two single quotes strtmp = Replace (Trim (str), "'", "" ")
Digital, to determine whether it can be converted to a digital type, using the IsNumeric function
What is now said on the Internet to be able to bypass single quotes is actually for numeric types
If there is a way to bypass the character type that filters the single quotes, it's no fun ...
