SQL注⼊攻击及解决⽅案
日本研究生⼀, 定义：所谓SQL注⼊攻击是应⽤程序开发⼈员未预期地把SQL代码传⼊到应⽤程序的过程，只有那些直接使⽤⽤户提供的值构造SQL语句的应⽤程序才会受影响.
例如原SQL代码为:
lect Orders.CustomerID,Orders.OrderID,Count(UnitPrice) as Items,SUM(UnitPrice*Quantity) as Total from Orders INNER JOIN [Order Details]on Orders.OrderID=[Order Details].OrderID
where Orders.CustomerID='"+txtId.Text+"' GROUP BY Orders.OrderID,Orders.CustomerID
解决⽅案：采⽤参数化命令:
菜饽饽的做法 如使⽤参数化命令重写前⾯的代码为:
protected void btnQuery_Click(object nder, EventArgs e)
石榴石图片{
string conStr = WebConfigurationManager.ConnectionStrings["Northwind"].ConnectionString;
SqlConnection con = new SqlConnection(conStr);
con.Open();
string strSql = "lect Orders.CustomerID,Orders.OrderID,Count(UnitPrice) as Items,SUM(UnitPrice*Quantity) as Total from Orders INNER JOIN [Order Details]on Orders.OrderID=[Order Details].OrderID where Orders.CustomerID=@Cus SqlCommand cmd = new SqlCommand(strSql, con);
cmd.Parameters.AddWithValue("@CustomerID", txtId.Text.Trim().ToString());
SqlDataReader reader = cmd.ExecuteReader();
GridView1.DataSource = reader;防控风险
小米路由器管理密码
GridView1.DataBind();
刘亦菲演的电影reader.Clo();
con.Clo();
最恐怖的鬼故事
}
什么大同成语
这样就可以避免SQL注⼊攻击.
