Delphi considers SQL injection QUOTEDSTR

Previously only in the BS architecture of the project to consider the SQL injection problem, but rarely consider the use of the Delphi project for many years should also consider the issue of SQL injection, today did an experiment, successfully completed the injection, the table data are all deleted, and then do Delphi Project also really consider this issue.

Generally speaking, generally know there are two ways to avoid the Delphi SQL injection: 1, the use of quotedstr instead of "" string splicing, 2, the use of parameters to interact with the database, this way to carefully experience the day.

Here is a small test, a simple INSERT statement, if the Edit1 content is
ABC ') delete from tb1 insert into TB1 (Id, Name) VALUES (123, ' xxxx
After running, the data in the TB1 table will all be cleared, leaving only the insert into TB1 (Id, Name) VALUES (123, ' xxxx
Add a piece of

[Delphi]View Plaincopy

2. Procedure TForm1.  Button1Click (Sender:tobject);
4. Var
6. sqlstr:string;
8. Begin
10. SQLSTR: = ' INSERT into TB1 (Id, Name) VALUES (1, ' "+ edit1.  Text + ') ';
12. Self. ADOQuery1. SQL.  Text: = Sqlstr;
14. Self. ADOQuery1.  Execsql;
16. ShowMessage (' successfully completed SQL injection ');
18. End

Change to Sqlstr: = ' insert into TB1 (Id, Name) VALUES (1, ' + quotedstr (edit1. Text) + ') ';

can be avoided.

Quotedstr refer to the following statement:

adoquery1.sql.text:=
' Select character number from yourtable where character type number = ' abc ' and integer number = 123 ';
Equivalent to
adoquery1.sql.text:=
' Select ' +afieldname+ ' from ' +atablename+ ' where ' +afieldname
+ ' = ' ' +astr+ ' and integer number = ' +anintstr;
is also equivalent to
adoquery1.sql.text:=
' Select ' +afieldname+ ' from ' +atablename+ ' where ' +afieldname
+ ' = ' +quotedstr (AStr) + ' and integer number = ' +inttostr (anint);
Upload to Database server:
Select character number from yourtable where character type number = ' abc ' and integer number =123

Delphi considers SQL injection QUOTEDSTR