Asp.net SQL注入執行個體分享

標籤：

??Asp.net SQL注入執行個體分享

1.web.config裡加連結欄位：

<configuration>  <connectionStrings >    <add name="myConnectionString"         connectionString="Server=10.231.248.177;Database=testdb;User ID=sa;Password=pa$$word;Trusted_Connection=False;"         providerName="System.Data.SqlClient"/>  </connectionStrings>

2.拖幾個控制項在form裡：

<form id="form1" runat="server">        <asp:Label ID="LU" runat="server" Text="User Name:"></asp:Label>        <asp:TextBox ID="TBU" runat="server"></asp:TextBox>        <br/>        <asp:Label ID="LP" runat="server" Text="Password:"></asp:Label>        <asp:TextBox ID="TBP" runat="server"></asp:TextBox>        <br/>        <asp:Button ID="Login" runat="server" Text="Login" OnClick="Login_Click" />    <div>

3.寫登入事件：

protected void Login_Click(object sender, EventArgs e)    {        using(SqlConnection con = new SqlConnection(WebConfigurationManager.ConnectionStrings["myConnectionString"].ConnectionString))        {            con.Open();            SqlCommand cmd = new SqlCommand();            cmd.CommandText = "SELECT Count(1) FROM [User] where UserName=‘" + TBU.Text.Trim() + "‘ and Password=‘" + TBP.Text.Trim() + "‘";            cmd.CommandType = CommandType.Text;            cmd.Connection = con;            int count =(int) cmd.ExecuteScalar();            Response.Write(cmd.CommandText);            if (count > 0)            {                Response.Write("<script>alert(‘Login pass!‘);</script>");            }            else            {                Response.Write("<script>alert(‘Login fail!‘);</script>");            }        }    }

4.構造SQL注入登入：

使用者名稱輸入：test‘ or ‘‘=‘

密碼輸入：‘ or ‘‘=‘

其他ASP.net SQL注入的例子，如果有興趣可以參考下：

http://www.aspsnippets.com/Articles/SQL-Injection-Attack-its-examples-and-Prevention-mechanisms-and-Techniques-in-ASPNet.aspx

http://www.codeproject.com/Articles/459324/Understading-SQL-Injection-and-Creating-SQL-Inject

http://blogs.iis.net/nazim/sql-injection-demo

其他的SQL注入：http://www.unixwiz.net/techtips/sql-injection.html

著作權聲明：本文為博主原創文章，未經博主允許不得轉載。

Asp.net SQL注入執行個體分享