一种基于信息安全的Web系统数据库设计与访问策略——以安徽开放大学网上教学活动安排系统为例  

Design and Access Strategy of Web System Database Based on Information Security:Taking Anhui Open University Online Teaching Activity Arrangement System as an Example

作　　者：杨建华 李斌 YANG Jianhua;LI Bin(Anhui Open University,Hefei 230022,China)

机构地区：[1]安徽开放大学,合肥230022

出　　处：《安徽开放大学学报》2023年第3期87-91,共5页Journal of Anhui Open University

基　　金：安徽省高校自然科学重点项目(项目编号:KJ2020A1221);安徽省质量工程项目(项目编号:2020jyxm0264)。

摘　　要：针对当前Web系统数据库在设计时存在表名与列名命名简单、易被猜出,数据访问操作使用用户输入内容拼接构建SQL查询语句存在的安全隐患问题,提出一种对数据库中数据表、字段统一命名,用户输入内容参数化,数据访问操作封装化的策略。实践结果表明:应用这一策略能有效防止SQL注入攻击,规范了数据库访问操作,提升了代码的重用率。In view of the existing security problems in the design of the current Web system database,such as the simple naming of table names and column names,which are easy to guess,and the use of user input content splicing to construct SQL query statements in data access operations,a strategy of unified naming of data tables and fields in the database,parameterization of user input content,and encapsulation of data access operations is proposed.By applying this strategy in the online teaching activity arrangement system of Anhui Open University,it is concluded that it can effectively prevent SQL injection attacks,standardize database access operations,and improve the code reuse rate.

关 键 词：信息安全 WEB系统 数据库设计 SQL注入攻击 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]