基于SQL注入攻击的三种防御技术  

Three Defense Technologies Based on SQL Injection

作　　者：李晓龙[1] 

机构地区：[1]襄阳职业技术学院外国语学院,湖北襄阳441050

出　　处：《湖北文理学院学报》2013年第5期18-21,共4页Journal of Hubei University of Arts and Science

摘　　要：SQL注入攻击是基于ASP/ASP.NET+ACCESS/SQL Server架构的Web应用程序和数据库系统,将非法的SQL命令语句通过正常的数据传递渠道提交至数据库内部执行,从而达到篡改、破坏数据的目的.针对此,三种基于SQL注入攻击的防御技术:参数化查询、存储过程和URL重写,通过实例来验证和比较它们的防御效果,为合理选择使用、提高Web应用程序的安全性提供一定的参考和借鉴.SQL injection attack refers to Web application programs and database system, based on ASP/ASENET＋ACCESS/SQL Server structure, submits illegal SQL command to database via normal data transference chanel, which aims at tampering with data. The paper carries out research on several defense technologies against SQL injection attacks currently from parameter query, storage process and URL rewriting to make comparison through case study, which is helpful to improve safety of Web application programs.

关 键 词：SQL注入攻击 参数化查询 存储过程 URL重写 防御技术 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]