资源描述：
《SQL注入攻击的原理及其防范措施》由会员上传分享，免费在线阅读，更多相关内容在工程资料-天天文库。
1、SQL注入攻击的原理及其防范措施()TheprincipleofSQLinjectionattackanditspreventivemeasuresCategory:SQLinjectionvulnerabilitytopic2008-12-1214:08readingreview(0)reportcollectionTheASPprogrammingthresholdisverylowandthenoviceiseasytohittheroad.Forashortperiodoftime,noviceshavebe
2、enabletomakeuptheseeminglyperfectdynamicwebsite,which,infunction,canbedonebyoldhands,andthenovicecandoit.Istherenodifferencebetweenanoviceandaveteran?It'sabigdifferenee,butit'shardforthelaymantoseeit.Theinterface'sfriendliness,performance,andsecurityofthesitear
3、ethethreefocalpointsthatdifferentiatebetweennoviceandveteran・Intermsofsecurity,themostoverlookedissueforbeginnersistheproblemofSQLinjectionvulnerabilities・UseNBSI2.0toseansomeonlineASPwebsitealittlebit,youcanfindmanyASPwebsitehaveSQLinjectionvulnerabilities,edu
4、cationnetworkincollegesanduniversitiesinternalorganizationsomewebsitethisvulnerabilityismorecommon,perhapsthisisbecausemostofthesesitesisthatsomestudentsdo,althoughallareveryclever,butafterall,noexperience,andinlearning,hardtoavoidvulnerability・Thisarticlefocus
5、esonthepreventionmeasuresofSQLinjection,andtounderstandtheuseoftheseprecautions,weneedtoexplainindetailtheinvasionofSQLinjection.Thebeginnersseeit.Quiteafewprogrammerswritecodewithoutjudgingthevalidityoftheuser，sinputdata,makingtheapplicationunsafe・Ifthisisanor
6、malwebsiteathttp://localhost/lawjia/show・asp?ID二444,aftertheurltosubmittotheserver,theserverwillbesimilartoSelect*fromtablename二wherefield&IDquery(IDthatissubmittedbytheclientparameters,thisexampleisthe444),thenthequeryresultsreturnedtotheclient,iftheclienthere
7、deliberatelycommitsuchawebsite:http://localhost/lawjia/show.asp?ID二444anduser>0,whentheserverrunstheSelect*fTomtablenamewherefield二444anduser>0,ofcourse,thisstatementisnotrunning,itmustbewrong,theerrormessageisasfollows:•wrongtype:MicrosoftOLEDBProviderforODBCD
8、rivers(0x80040E07)[Microsoft][ODBCSQLServerDriver][SQLServer]convertsnvarcharvalue'sonybb，toanintcolumnwithasyntaxerror.Line/1awjia/show.Asp,47However,someonewithulteriormot
