How to Configure Nginx to prevent SQL injection attacks

Defense principle:

1. Filter the injection keywords in the basic url through the above configuration;
2. Of course, the user password in the database must be encrypted and stored;
3. The php program performs secondary filtering to filter keywords in GET and POST variables;
4. Disable the error message of PHP and MySQL in the production environment.

SQL injection attacks are generally the request parameters following the question mark, which are represented by $ query_string in nginx.

For example, if 'in the parameter is matched with single quotes and then directed to the error page,/plus/list. php? Tid = 19 & mid = 1124'

The code is as follows:

Rewrite ^. * ([; '<>]). */error.html break;

Directly writing such an rewrite will certainly not match correctly, because the rewrite parameter will only match the requested uri, that is, the/plus/list. php part.
You need to use $ query_string to determine with if. if the query string contains special characters, 404 is returned.

The code is as follows:

If ($ query_string ~ * ". * [; '<>]. *") {Return 404 ;}

Set some concurrencies

The code is as follows:

If ($ request_uri ~ * "(Cost () | (concat ()"){
Return 404;
        }
If ($ request_uri ~ * "[+ | (% 20)] union [+ | (% 20)]") {
Return 404;
        }
If ($ request_uri ~ * "[+ | (% 20)] and [+ | (% 20)]") {
Return 404;
        }
If ($ request_uri ~ * "[+ | (% 20)] select [+ | (% 20)]") {
Return 404;
        }

If ($ query_string ~ * ". * [; '<>]. *") {
Return 404;
}

The following describes how to disable file injection.

The code is as follows:

# Disable file injection
 
Set $ block_file_injections 0;
 
If ($ query_string ~ "[A-zA-Z0-9 _] = http ://"){
 
Set $ block_file_injections 1;
 
}
 
If ($ query_string ~ "[A-zA-Z0-9 _] = (..//?) + "){
 
Set $ block_file_injections 1;
 
}
 
If ($ query_string ~ "[A-zA-Z0-9 _] =/([a-z0-9 _.] //?) + "){
 
Set $ block_file_injections 1;
 
}
 
If ($ block_file_injections = 1 ){
 
Return 444;
 
}

Many injection prevention methods are not described here. For more information, see.