Web网站的安全代码设计  

Safety Code Design for Website

作　　者：戴明星[1] 陈正奎[1] 

机构地区：[1]浙江省地方税务局信息中心,浙江杭州310007

出　　处：《信息安全与通信保密》2010年第10期92-94,共3页Information Security and Communications Privacy

摘　　要：针对Web网站突出的安全问题,详细分析了当前对Web网站安全威胁最严重的3种网络攻击:SQL注入、跨站和跨站请求伪造的实现原理和常用攻击方法,并结合研究和实践提出了具体的防范算法:采用过滤用户提交Web请求中的非法字符串代码实现了SQL注入及跨站的防范算法,具体代码使用了JSP中的Servlet过滤器实现;采用伪随机数对用户端身份进行持续认证的方式实现了跨站请求伪造算法。For the prominent safety issue of the website, the paper analyzes in depth the three most serious attacks against the website security, that is, SQL injection, cross-site scripting, and cross-site request forgery. In combination of study and practice, an anti-attack algorithm against SQL injection and cross-site scritpting by filtering out the illegal string code from the requests of the website user is proposed, the servlet filter in JSP is employed to realize the specific code, while an anti-attack algorithm against cross-site request forgery by using pseudo-random number to continuously authenticate the user also presented.

关 键 词：SQL注入 跨站 跨站请求伪造 安全代码 

分 类 号：TP393.092[自动化与计算机技术—计算机应用技术]