Prevent SQL Server injection attacks

SQL injection attacks are designed to attack the system by exploiting vulnerabilities. If user input data is not filtered when SQL statements are dynamically generated, the SQL injection attacks will be successful.
For example:
Use the following SQL statement to determine the user name and password:
TxtSQL = "select * from user_Info where user_ID = '" & txtusername. text & "' and Password = '" + txtpassword. text & "'", cnn, adOpenKeyset, adLockOptimistie
Then, the SQL injection attack is used. In the "password" text box, enter 1 'or '1' = '1. illegal users can easily log on to the system without a password, because the SQL statement becomes:
TxtSQL = "select * from user_Info where user_ID = '" & txtusername. text & "'and Password ='" & 1' or '1' = '1 & "'", cnn, adOpentKeyset, adLockOptimistie
Because 1 'or '1' = '1 is a true statement, then the select statement becomes. txtSQL = "select * from user_Info", all the information is queried, therefore, you can log on to the system without a password.
For more SQL Injection Attack statements, see my master's blog <ASP Injection Vulnerabilities (most comprehensive)> and <SQL injection attacks per day>, <advanced SQL Injection in SQL Server Applications>
 
To break the law against SQL injection attacks, pay attention to the following issues:
1. Check the content of the entered SQL statement. If it contains sensitive characters, delete sensitive characters, including ', >,<= ,,! ,-, +, *,/, (), | And Space
2. Do not create a WHERE clause during user input. You should use parameters to use stored procedures.
 
 
Prevent SQL injection attacks:
(1) Compile a function to filter sensitive characters. The function is as follows:
 
Change the select query statement:
TxtSQL = "select * from user_Info where user_ID = '" & txtusername. text & "'and Password ='" + inputString (txtpassword. text) & "'", cnn, adOpenKeyset, adLockOptimistie
After using this function, illegal users cannot log on to the system illegally!
 
(2) filter sensitive characters through stored procedures
First, define the Stored Procedure xtdl in SQL Server, and then write the code in the program design:
 

 

 
These are two ways to prevent SQL injection attacks. I hope to help you. in future database operations, we will certainly encounter such a problem. If there is a problem, there will certainly be a solution!
Author Tang Huan