Java Web SQL injection Test (4)--How to prevent such defects from occurring

Check the legality of user input, make sure that the input content contains only legitimate data, the data inspection should be performed on both client and server side to perform server-side validation, is to compensate for the weak security of client authentication mechanism. At the client, it is entirely possible for an attacker to obtain the source code of the Web page, modify the script that validates the legitimacy (or delete the script directly), and then submit the illegal content to the server through the modified form. Therefore, the only way to ensure that the validation operation is actually performed is to perform validation on the server side.

Second: Escape sensitive characters.

Escape sensitive characters and strings (SQL sensitive characters include "exec", "xp_", "sp_", "declare", "Union", "cmd", "+", "//", "..", ";", "'", "--", "%", "0x", "><= !-*/() | ", and" space ").

Third: Error message handling

Prevent SQL injection, and avoid some verbose error messages, because hackers can take advantage of these messages. A standard input validation mechanism is used to verify the length, type, statement, enterprise rules, and so on for all input data.

IV: Encryption processing

Encrypt data such as user login name, password, and so on. Encrypt the data entered by the user and compare it to the data saved in the database, which is equivalent to "disinfect" the data entered by the user, and the data entered by the user no longer has any special meaning to the database, thus preventing the attacker from injecting SQL commands.

V: Stored procedure to execute all queries

The way SQL parameters are passed prevents attackers from using single quotes and hyphens to enforce attacks. In addition, it allows database permissions to be restricted to only certain stored procedure executions, and all user input must follow the security context of the stored procedure being called, making it difficult to inject attacks again.

Sixth: Never use dynamically assembled SQL.

You can use parameterized SQL or use stored procedures directly for data query access.

Java Web SQL injection Test (4)--How to prevent such defects from occurring