SQL注入和可能的攻击 [英] SQL Injection and possible attacks

问题描述

您好我有以下查询，这是一个java类的一部分。我只想知道什么是可能的攻击可能与SQL注入。攻击者如何注入查询？在这种情况下，可以使用哪些样本查询来访问数据库？

Hi I have the following query which is part of a java class. I just want to know what are the possible attacks possible with the SQL Injection. How an attacker can inject queries? What are sample queries in this case that can be used to gain access to the database?

    String query = ("SELECT username, password, admin FROM users 
    WHERE "  + "username='" + username + "' AND password='" + 
    password + "'"); 
    ResultSet rs = st.executeQuery(query); 
    // Entry in the result set means the query was successful and 
    //the user is a valid user
    if (rs.next()) { 
    username = rs.getString(1); 
    isAdmin = rs.getBoolean(3);   

我认为这是一种可能的攻击方式，将用户名作为abc';＃ ＃将被视为SQL中的注释。其他人怎么想？

I think this is a possible way of attack also by putting username as abc';# since anything after # will be considered as a comment in SQL. What others think about it?

我想知道攻击者在HTML页面的用户名框和密码框中输入的内容，以获得作为管理员的访问权限。假设上述java类的作业是通过查询数据库来处理来自HTML页面的用户输入的请求。

I want to know what the attacker will be entering in the username box and password box of the HTML page to gain access as an administrator. Assuming the job of the above java class is to process the request of the users's input from a HTML page by querying a database.

推荐答案

基本上像这样工作 https://xkcd.com/327/

我所做的是假设用户输入的一切都是威胁，所以我会保存所有变量，如 usUsername ，其中us表示不安全。
之后，我检查每个us - 变量注入，结果在 sUsername （s表示安全）。所以当我构建一个查询时，我只能使用s-varaibles，并且在大多数情况下应该是安全的。

what I do is assuming, that everything a user inputs is a threat, so I would save everything to variables like usUsername, where "us" means unsafe. After that I check every "us"-variable for injections, what results in sUsername (s means safe). So when I build a query I can only use s-varaibles and should be safe in most cases.

这个想法完全取自这里： http://www.joelonsoftware.com/articles/Wrong.html

This idea is totally taken from here: http://www.joelonsoftware.com/articles/Wrong.html

这篇关于SQL注入和可能的攻击的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！