Analysis of New SQL Injection Detection Methods

Analysis of New SQL Injection Detection Methods
1. Open the address and we can see that it is a normal page. 2. Add-1 to the address and change it: http://site/news.asp?id=123 -1. If the returned page is different from the previous page and is another normal page, the injection vulnerability exists and is a digital injection vulnerability. 3. If-0 is added to the address, it becomes http://site/news.asp?id=123 -0: The returned page is the same as the previous page. If-1 is added, the error page is returned, indicating that the injection vulnerability exists and is digital. 4. If '% 2B' is added to the address, it is changed: http://site/news.asp?id=123 '% 2B', the returned page is the same as the previous one; add '2% 2B 'sb, and the address is changed: http://site/news.asp?id=123 '% 2Bsb, return to another normal page, or if this record or error is not found, the injection vulnerability exists and is in the text format. Cause Analysis: If the SQL statement is executed in this way (number): select * from news where id = 123 After-1 is added, the statement is changed to select * from news where id = 123-1, but when the SQL server executes this statement, it first calculates 122-1, and then runs: select * from news where id = 122 is another page record. If this page exists, it is another page; otherwise, the record does not exist or an error occurs. This also indicates that the program does not filter the input data and has the numeric injection vulnerability. If the SQL statement is executed in this way (character): select * from news where id = '000000' followed by '% 2B', the statement becomes: select * from news where id = '000000' + "(% 2B is the URL encoding of +) What the SQL server actually executes is: select * from news where id = '000000 ′, returns the same page. After '% 2B' sb is added, the statement becomes: select * from news where id = '000000' + 'SB '(likewise, the SQL statement will first execute '200' + 'SB '). The actual execution of the SQL statement is: select * from news where id = '123sb'. The returned page does not exist or an error is displayed, indicates a text injection vulnerability.