sql注入攻击可以在asp经典中停止 [英] sql injection attack can be stop in asp classic

问题描述

hi

i下面的代码：

hi
i write code below :

set conn=server.createobject("adodb.connection")

mytb = "DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=" & server.mappath("tdr.mdb")
conn.Open mytb

Dim  mysql
mysql = "insert into feedback(comments,username,useradd,useremail,usertel,userdt) " &_
              "values('" & mcomments & "','" &_
              musername & "','" &_
              museradd & "','" &_
              museremail & "','" &_
              musertel & "','" &_
              muserdt & "')"
conn.execute(mysql)
conn.close
set conn=nothing

现在告诉我在哪里写一些防止sqlinjection攻击的代码。

感谢和问候

Umesh Daiya

now tell me where i write some code to prevent sqlinjection attack.
Thanks and regards
Umesh Daiya

推荐答案

您正在将值连接到SQL命令中，而不是使用参数化命令。请参见 http://bobby-tables.com/ [ ^ ]

You are concatenating values into your SQL command, instead of using parameterised commands. See http://bobby-tables.com/[^]

这篇关于sql注入攻击可以在asp经典中停止的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！