SQL注入漏洞的分析及防范  

On analysis and prevention of SQL injection

作　　者：钟增胜[1] 

机构地区：[1]重庆工商大学招生就业处,重庆400067

出　　处：《重庆工商大学学报（自然科学版）》2005年第6期592-596,共5页Journal of Chongqing Technology and Business University:Natural Science Edition

摘　　要：阐述了SQL注入的原理,对SQL注入的一般思路进行了详细分析;通过整形参数和字符串参数来判断是否存在注入漏洞,再通过判断数据库类型和数据库表名及字段名来达到注入的不同目的;介绍了多种注入方式,并从服务器管理员和程序员2个方面对SQL注入漏洞提出了防范措施。The principles of SQL injection are discussed, and its general laws are analyzed in detail. SQL injection can be judged with reshaping and character string parameters and the aim of injection can be judged according to the type, table name and field name of database. A few ways of injection are introduced. The countermeasures are thus proposed for serve administrators and programmers.

关 键 词：ASP SQL注入 入侵攻击 安全防范 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]