Web site bug fixes prevent SQL injection of XXX vulnerabilities

SQL injection vulnerability in the Web site vulnerability is a high-risk vulnerability, ranked in the top three, affected by a wide range, such as ASP,. NET, PHP, Java, and other programming languages written code, there are SQL injection vulnerabilities, then how to detect the existence of SQL injection vulnerability?

SQL Injection Vulnerability test method

In the program code, whether it is get commits, post submissions, cookies, can have arbitrary control parameters of a parameter value, through the use of SQL injection tools, classic sqlmap for detection and exploit, you can also use some of the domestic SQL code injection tools, The simplest method of security testing is to test the SQL injection vulnerability by using character injection of the database's single quotes, and 1=1 and 1=2, and so on.

SQL Injection Vulnerability Anatomy

In the program code of the website, there are a number of parameters that users need to submit, such as GET, post data submitted, some programmers do not have detailed security filtering, resulting in the direct execution of SQL statements, in the parameters submitted can be mixed with some malicious SQL statement commands, For example, query the admin account password, query the database version, and query the user's account password, execute write a word XXX to the database configuration file, execute the System command power, and so on.

SQL Injection Vulnerability Fix

In the bottom of the program code, the SQL bug patching and protection, in the code to add filtering some illegal parameters, server-bound variables, SQL statement standardization, is to prevent the web site by SQL injected xxx the best way. Sine security Company is a focus on: Web site security, server security, website security detection, site vulnerability repair, XXX testing, security services in one of the network security services provider.

One, the program code in all query statements, the use of standardized database query statement API interface, set the parameters of the statement to filter some illegal characters, prevent users from entering malicious characters into the database to execute SQL statements.

Second, the user submits the parameter security filter, like some special characters (, () *&......% #等等) carries on the character escaping operation, as well as the code safe conversion.

Third, the site code layer coding as far as possible, it is recommended to use UTF8 encoding, if the code is not the same coding, will cause some filtering is directly bypassed.

Four, the website data type, must determine, is the digital type, is the numeral type, the character type is the character type, the storage field type in the database is also set to the INI type.

Five, the user's operational rights to security restrictions, ordinary users only to ordinary permissions, admin background operation permissions to release, as far as possible to reduce the database of malicious xxx.

Six, the website error information try not to return to the client, such as some character errors, database error information, as far as possible to prevent leakage to the client.

Seven, if the website program code is not familiar with the proposal to professional to do security company professional treatment, domestic recommended Sinesafe, Green League, Enlightenment stars.

Web site bug fixes prevent SQL injection of XXX vulnerabilities