基于参数查询防止SQL注入攻击的方法  

A Method to Defend against SQL Injection Attack Based on Parameter Query

作　　者：隋励丽[1] 张恒博[1] 

机构地区：[1]大连民族学院计算机科学与工程学院,辽宁大连116605

出　　处：《大连民族学院学报》2012年第5期495-497,共3页Journal of Dalian Nationalities University

摘　　要：本文分析了SQL注入攻击的原理和攻击步骤的方法,针对ASP网站重点分析了SQL注入攻击的实现原理、实现过程,并且针对性地提出了利用参数查询有效预防SQL注入攻击的策略实现。该策略包括检查用户输入、使用类型安全的SQL参数、使用存储过程、进行数据加密以及进行安全部署等,能很好地加强ASP网站应用程序的安全性,可有效防范绝大多数针对网站本身SQL注入式攻击。This paper describes the principle and the methods of SQL injection attacks.And the paper puts the emphasis on the implementation methods and procedures of SQL injection attacks to the ASP website.The strategies are proposed to defend SQL injection attacks effectively by using the parameter query methods,which include checking user input,using type-safe SQL parameters,using stored procedures and so on.And the data encrypting and security deployment are used as well.The methods proposed in this paper can reinforce the security of the ASP web application,and can effectively prevent the website from the most of SQL injection attacks.

关 键 词：SQL SQL注入攻击 参数查询 ADO 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]