Five methods to prevent jsp from being injected by SQL

 

I. Introduction to SQL Injection

 

SQL injection is one of the most common methods of network attacks. It does not use Operating System bugs to launch attacks, but is aimed at the negligence of programmers during programming. through SQL statements, you can log on without an account, or even tamper with the database.

========================================================== ===

 

II. General idea of SQL injection attacks

 

1. Find the SQL Injection Location

2. Determine the server type and backend database type

3. SQL injection attacks against inaccessible servers and databases

========================================================== ===

 

Iii. SQL injection attack instances

 

For example, you must enter the user name and password on a logon page:

 

You can enter the account-free logon mode as follows:

 

Username: 'or 1 = 1-

Password:

 

Click Login. If no special processing is performed, this illegal user will be very proud to log in. (Of course, the database APIs in some languages have already handled these problems)

 

Why? The following is an analysis:

 

Theoretically, the background authentication program has the following SQL statement:

 

String SQL = "select * from user_table where username =

'"+ UserName +"' and password = '"+ password + "'";

 

When the above user name and password are entered, the preceding SQL statement becomes:

 

SELECT * FROM user_table WHERE username =

''Or 1 = 1 -- and password =''

 

Analyze SQL statements:

If username = "or 1 = 1 username equals" or 1 = 1, the condition will succeed;

Then add two-, which means that the comment is followed by the statement, so that they do not work, so that the statement can always be correctly executed, and the user can easily cheat the system and obtain a valid identity.

 

This is gentle.

 

SELECT * FROM user_table WHERE

Username = ''; drop database (DB Name) -- 'and password =''

 

.... The consequences can be imagined...

========================================================== ====

 

Iv. Countermeasures

 

Next I will discuss the countermeasures for JSP:

 

1. (simple and effective method) PreparedStatement

 

The pre-compiled statement set is used. It has built-in SQL Injection processing capabilities. You only need to use its setXXX method to pass values.

 

Benefits:

(1). code readability and maintainability.

(2). PreparedStatement to maximize performance.

(3). The most important thing is to greatly improve security.

 

Principle:

SQL injection only damages the preparation (Compilation) process of SQL statements.

The PreparedStatement is ready. In the execution stage, the input string is used as data processing,

Instead of parsing and preparing SQL statements, SQL injection is avoided.

========================================================== =====

 

2. Use regular expressions to filter input parameters

 

Package to be introduced:

Import java. util. regex .*;

 

Regular Expression:

Private String CHECKSQL = "^ (. +) \ sand \ s (. +) | (. +) \ sor (. +) \ s $ ";

 

Determine whether a match exists:

Pattern. matches (CHECKSQL, targerStr );

 

The following is a specific regular expression:

Check the Regular Expression of SQL meta-characters:

/(\ % 27) | (\ ') | (\-) | (\ % 23) | (#)/ix

Corrected the regular expression used to check SQL meta-characters:/(\ % 3D) | (=) [^ \ n] * (\ % 27) | (\') | (\-) | (\ % 3B) | (:))/I

Typical Regular Expression for SQL injection attacks:/\ w * (\ % 27) | (\ ') (\ % 6F) | o | (\ % 4F )) (\ % 72) | r | (\ % 52)/ix

Check SQL injection. Regular Expression of the UNION query Keyword:/(\ % 27) | (\ ') union/ix (\ % 27) | (\')

Regular Expressions used to detect ms SQL Server SQL injection attacks:

/Exec (\ s | \ +) + (s | x) p \ w +/ix

And so on .....

========================================================== =

 

3. String Filtering

 

A common method:

(| Parameters can be added based on the needs of your program)

========================================================

 

Public static boolean SQL _inj (String str)

{

String inj_str = "'| and | exec | insert | select | delete | update |

Count | * | % | chr | mid | master | truncate | char | declare |; | or |-| + | ,";

String inj_stra [] = split (inj_str, "| ");

For (int I = 0; I & lt; inj_stra.length; I ++)

{

If (str. indexOf (inj_stra [I]) & gt; = 0)

{

Return true;

}

}

Return false;

}

 

========================================================== =

4. Call this function in jsp to check whether the letter contains invalid characters.

========================================================

 

Prevent SQL from URL injection:

 

SQL _inj.java code:

========================================================

 

Package SQL _inj;

 

Import java.net .*;

Import java. io .*;

Import java. SQL .*;

Import java. text .*;

Import java. lang. String;

 

Public class SQL _inj {

Public static boolean SQL _inj (String str)

{

String inj_str = "'| and | exec | insert | select | delete | update |

Count | * | % | chr | mid | master | truncate | char | declare |; | or |-| + | ,";

// You can add items here

String [] inj_stra = inj_str.split ("\\| ");

For (int I = 0; I & lt; inj_stra.length; I ++)

{

If (str. indexOf (inj_stra [I]) & gt; = 0)

{

Return true;

}

}

Return false;

}

}

 

==============================================

5. JSP page judgment code:

==========================================

 

Use javascript to mask insecure characters on the client

 

Function Description: Check whether "'", "\", "/" is included "'","\\","/"

Parameter description: string to be checked

Returned value: 0: 1: No

The function name is

Function check ()

{

Return 1;

Fiber DN = new Array ("'","\\","/");

I = maid. length;

J = a. length;

For (ii = 0; ii <I; ii ++)

{For (jj = 0; jj <j; jj ++)

{Temp1 = a. charAt (jj );

Temp2 = maid [ii];

If (tem '; p1 = temp2)

{Return 0 ;}

}

}

Return 1;

 

}

==========================================

 

In general, to prevent general SQL injection, you only need to work hard on code specifications.

When there are variables in the SQL statements involved in execution, you can use the PreparedStatement provided by JDBC (or other data persistence layers). Remember not to concatenate strings.

 

From tianxingjian