如何避免SQL注入攻击？ [英] How can I avoid SQL injection attacks?
问题描述
昨天我和一个开发人员说话，他提到一些关于限制数据库字段插入的东西，比如 - （减去负号）。 p>
在同一类型，我知道这是一个很好的方法来转义HTML字符，如< ，> 等。 - 。这是真的？我必须担心 - ， ++ 吗？
更新
非常感谢所有的答案，这是很容易理解，因为我是一个新的所有这一切。
在这种情况下，为了更具体，我们的讨论是关于和我们正在开发的ASP.NET MVC网站，所以有一个复杂的开放的帐户表单中有重要的信息，所以我不知道如果MVC使用Linq与数据库接口已经有了这种保护或不是。所以如果任何人可以提供一些提示，这将是巨大的。
再次感谢
避免SQL注入攻击的正确方法不是简单地禁止某些概念字符，使用参数化的SQL。你可以在这里找到一些关于参数化SQL主题的好文章：
http://www.codinghorror.com/blog/archives/000275.html
http://www.codeproject.com/KB/database/ParameterizingAdHocSQL.aspx
现在你提到你正在使用ASP.net，我可以给你一些链接，专门处理ASP中的SQL注入。
http://en.csharp-online.net/ASP .NET_Security_Hacks％E2％80％94Avoiding_SQL_Injection
http://www.codeproject.com/KB/aspnet/SQL_Injection_.aspx?msg=3209511
这是一篇有关制作ASP的更一般的文章更安全：
http://www.codeproject.com/KB /web-security/Securing_ASP_NET_Apps.aspx
当然，MSDN文章SQL注入：
http://msdn.microsoft.com/en-us/library/ms998271.aspx
Yesterday I was speaking with a developer, and he mentioned something about restricting the insertions on database field, like, strings such as -- (minus minus).
At the same type, what I know is that is a good approach to escape HTML chars like <, > etc. Not --. Is this true? Do I have to worry about --, ++? Is it more like a myth or old stuff?
Update
Thanks a lot for all the answers, it's easy to understand like that since I'm kind of new to all of this. Well, to be more specific in this case our discussion was about and C# ASP.NET MVC website we're developing, so there's a complex open an account form in there with important information, so I'm not sure if MVC using Linq to interface with database already comes with this kind of protection or not. So if anyone could provides some hints about it, it would be great. Thanks again
The proper way to avoid SQL Injection attacks is not so simply disallow certain problamatic characters, but rather to use paramaterized SQL. You can find some good articles on the subject of paramaterized SQL here:
http://www.codinghorror.com/blog/archives/000275.html
http://www.codeproject.com/KB/database/ParameterizingAdHocSQL.aspx
Now that you mentioned that you are working with ASP.net I can give you some links that deal specifically with SQL Injection in ASP.
http://en.csharp-online.net/ASP.NET_Security_Hacks%E2%80%94Avoiding_SQL_Injection http://www.codeproject.com/KB/aspnet/SQL_Injection_.aspx?msg=3209511
Here is a more general article on making your ASP more secure: http://www.codeproject.com/KB/web-security/Securing_ASP_NET_Apps.aspx
And, of course the MSDN article on SQL injection: http://msdn.microsoft.com/en-us/library/ms998271.aspx
这篇关于如何避免SQL注入攻击？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
