How to prevent SQL injection

Reprint: http://www.iteye.com/topic/617072

General idea of SQL injection attack:
Find SQL injection location, determine server type and background database type, and determine the possible performance

For some attackers, SQL injection is generally the approach. Here I also talk about the SQL injection method of sentiment.

Injection method:
Theoretically, the Certification Web page will have the type such as:
SELECT * from admin where username= ' XXX ' and password= ' YYY ' statements, it is easy to implement SQL injection if the necessary character filtering is not performed before this sentence is formally run.
As in the User Name text box, enter: ABC ' or 1=1--in the Password box input: 123 The SQL statement becomes:
SELECT * from admin where username= ' abc ' or 1=1 and password= ' 123 ' regardless of user input any user name and password, this statement will always be executed correctly, the user easily fooled the system, to obtain legal status.

Guess solution:
The basic idea is to guess the names of all the databases, guess each table name in the library, analyze the name of the table that holds the user name and password, guess each field name in the table, and guess the contents of each record in the table.
There is also a way to get your database name and the name of each table.
is through in the form of: http://www. . cn/news?id=10 ' Way to get your database name and table name by Error!

For JSP we generally take a strategy to deal with:

1, PreparedStatement
If you are already a slightly level developer, you should always replace statement with PreparedStatement.
Here are a few reasons
1), readability and maintainability of the code.
2), PreparedStatement the maximum possible performance improvement.
3), the most important point is to greatly improve the security.
So far, some people (including myself) don't even know the basic semantic SQL syntax.
String sql = "SELECT * from Tb_name where name= '" +varname+ "' and passwd= '" +varpasswd+ "'";
If we pass [' or ' 1 ' = ' 1] As name, enter it. The password is random, see what will become?
SELECT * from tb_name = ' or ' 1 ' = ' 1 ' and passwd = ' random ';
Because ' 1 ' = ' 1 ' is sure to be true, so you can pass any validation. What's more:
put ['; drop table tb_name;] Incoming in as VARPASSWD:
SELECT * from tb_name = ' random ' and passwd = '; drop table tb_name; Some databases will not make you successful, but there are a number of databases that can make these statements executable.
And if you use precompiled statements. Any content you pass in will not have any matching relationship with the original statement. (As long as the database itself supports precompilation, but there may not be any server-side database does not support the compilation, only a few desktop databases, that is, direct file access to the full use of pre-compiled statements, you do not have to do any of the incoming data.) and if you use normal statement, There may be a drop on it; And so do a very elaborate judgment and worry.

2. Regular expressions
2.1. Regular expression for detecting SQL Meta-characters/(\%27) | (\ ') | (\-\-)| (\%23) | (#)/ix
2.2. Fixed regular expression for detecting SQL Meta-characters/((\%3d) | ( =)) [^\n]* ((\%27) | ( \ ') | (\-\-) | (\%3b) | (:))/I
2.3. Typical SQL injection attack regular expression/\w* ((\%27) | ( \ ')) ((\%6f) |o| (\%4f)) ((\%72) |r| (\ )) /ix
2.4. Detection of SQL injection, union query keyword regular expression/((\%27) | ( \ ')) Union/ix (\%27) | (\ ')-single quote and its hex equivalent union-union keyword.
2.5. Regular expression/exec (\s|\+) + (s|x) P\w+/ix for detecting MS SQL Server SQL injection attacks

3. String filtering
public static string Filtercontent (string content) {
String flt = "' |and|exec|insert|select|delete|update|count|*|%
|chr|mid|master|truncate|char|declare|; |or|-|+|, ";
Stringfilter[] = flt.split ("|");
for (int i=0; I {
Content.replace (Filter[i], "");
}
return content;
}

4, unsafe word masking

This part uses JS to block, plays a small role, so the method of shielding the keyword although has a certain role, but in the actual application of these SQL keywords may also become a real query keyword, to that is you blocked the user is not able to use the normal. Just go up and down the code spec.
Where there are variables involved in the execution of SQL, using JDBC (or other data persistence layer) to provide such as: PreparedStatement, remember not to use the method of stitching strings.
Function Description: Check if it contains "'", "\ \", "/"
Parameter description: The string to check
Return value: 0: Yes 1: No
The function name is
function Check (a)
{
return 1;
FIBDN = new Array ("'", "\ \", "/");
I=fibdn.length;
J=a.length;
For (ii=0, ii {for (jj=0; JJ)

{Temp1=a.charat (JJ);
TEMP2=FIBDN[II];
if (TEM '; p1==temp2)
{return 0;}
}
}
return 1;
}

How to prevent SQL injection