Java Web SQL injection Test (3)---phenomenon analysis

Then why do the above problems occur? This is caused by improper control of the program code layer. If the Web front-end control of the input data strictly, the database will be manipulated by the string, the client to do the sensitive character escapes, or in the operational database of the DAO layer, the use of dynamic parameters of SQL, not the use of splicing SQL, can prevent the occurrence of such problems.

In general, if the tester understands the specific design of the DAO layer, if the use is non-splicing, it is basically possible to intercept most of these problematic SQL. If you use the stitching method, you can design the test cases and test them well.

So why non-splicing method can effectively prevent SQL injection test it?

Modify the upper part of the core code block, using dynamic SQL (Precompiled SQL Method):

String hql= "Delete from Department where name=?";

Query query = session.createquery (HQL);

Query.setstring (0, name);

There is a problem with the same code entered:

But the result was not deleted. Why is it?

Because the escape of sensitive characters in a string is implemented in the SetString method. The JDK provides the Preparedstatemen interface, in the MySQL jar package, PreparedStatement implements the PreparedStatement in the JDK, the SetString method is as follows:

2. Public void setString (int parameterindex, String x) throws SQLException {
4. If the passed string is null and then set this column to null
6. if (x = = null) {
8. SetNull (Parameterindex, Types.char);
10. } Else {
12. StringBuffer buf = new stringbuffer ((int) (x.length () * 1.1));
14. Buf.append (' \ ');
18. int stringlength = X.length ();
20. //
22. Note:buf.append (char) is _faster_ than
24. Appending in blocks, because the block
26. Append requires a system.arraycopy () ....
28. Go figure ...
30. //
32. for (int i = 0; i < stringlength; ++i) {
34. char c = X.charat (i);
38. Switch (c) {
40. Case 0:/* must is escaped for ' MySQL ' */
42. Buf.append (' \ \ ');
44. Buf.append (' 0 ');
48. break;
52. Case ' \ n ':/* must is escaped for logs */
54. Buf.append (' \ \ ');
56. Buf.append (' n ');
60. break;
64. Case ' \ R ':
66. Buf.append (' \ \ ');
68. Buf.append (' R ');
72. break;
76. Case ‘\\‘:
78. Buf.append (' \ \ ');
80. Buf.append (' \ \ ');
84. break;
88. Case ‘\‘‘:
90. Buf.append (' \ \ ');
92. Buf.append (' \ ');
96. break;
100. Case ' ':/* Better safe than sorry */
102. if (this. Usingansimode) {
104. Buf.append (' \ \ ');
106. }
110. Buf.append (' "');
112. break;
116. Case ' \032 ':/* This gives problems on Win32 */
118. Buf.append (' \ \ ');
120. Buf.append (' Z ');
124. break;
128. default:
130. Buf.append (c);
132. }
134. }
138. Buf.append (' \ ');
142. String parameterasstring = buf.tostring ();
146. byte [] parameterasbytes = null;
150. if (! this. isloaddataquery) {
152. Parameterasbytes = Stringutils.getbytes (parameterasstring,
154. this. Charconverter, this. charencoding, this. Connection
156. . getservercharacterencoding (), this. Connection
158. . Parserknowsunicode ());
160. } Else {
162. Send with Platform character encoding
164. Parameterasbytes = Parameterasstring.getbytes ();
166. }
170. Setinternal (Parameterindex, parameterasbytes);
172. }
174. }

HQL There are many other methods for dynamic parameter binding: Binding by parameter name, binding by parameter location, Setparameter () method, and so on. Http://baike.baidu.com/link?url=NKt6I-Gk0HnyFRWyZ0_ZuDe0pz_aDqVul-VDJZCDCGl9K5LsBghBfxhPVJmZh9qmBKtXgY2EqAqK1oQUNK2Su_

Java Web SQL injection Test (3)---phenomenon analysis