SQL注入攻击检测与防御研究  

Detection of SQL injection attacks and the defense

作　　者：齐林[1] 王静云 蔡凌云[1] 陈宁波[1] 

机构地区：[1]河北科技大学信息科学与工程学院,河北石家庄050018 [2]河北省纺织纤维玖仟质量认证咨询中心,河北石家庄050018

出　　处：《河北科技大学学报》2012年第6期530-533,共4页Journal of Hebei University of Science and Technology

基　　金：河北省科技支撑计划资助项目(10213562)

摘　　要：简要介绍了SQL注入攻击的原理,对SQL注入攻击方式进行了分析,总结了SQL注入攻击的流程。根据SQL注入攻击的基本原理以及入侵前和入侵后的检测方法不同,提出了SQL注入攻击检测的方法,并在此基础上给出了一种基于客户端和服务器端的SQL注入攻击的防御模型,经过测试表明该模型的计算时间复杂度低,具有安全性和通用性,解决了网络中存在的SQL注入攻击问题。This paper briefly introduced the principle of SQL injection attack, analyzed the SQL injection attack mode, and summarized the process of SQL injection attack. According to the basic principle of SQL injection attack and the different detec- tion methods before the invasion and after the invasion, the SQL injection attack detection method was proposed, and SQL injection attack defense model based on the client and the server was given. The test shows that the models calculation time complexity is low, and it meets the safety and generality requirements. The method can be used to solve SQL injection attack problem in the network.

关 键 词：SQL注入 攻击检测 参数传递 防御模型 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]