SQL injection attack

• Catalog

  What is? SQL Injection attack

  Attack Demo

  SQL The principle of injection attack

  SQL Solution to injection attack

  perform sql sentence

  ---

• What is? SQL Injection attack

• Is the use sql Statement to attack the system

• Attack Demo

• For example, when entering the password sql Statement validation
• Such as ：

• select * from user where loginname='zhangsan' and password='123456'

• This statement requires an account number of zhangsan And the password is 123456 To login successfully
• But if you enter the account number casually but enter the password bbb' or '1'='1
• In the incoming statement is

• select * from user where loginname='aaa' and password='bbb' or '1'='1'

• That's right, then login is successful
• This is it. sql Injection attack

• SQL The principle of injection attack

• In the normal sense , Everything we type in the password , It's supposed to be a combination of passwords
• But now Statement Object is executing sql When the sentence is , A part of the password is executed as a query condition , Once the following conditions are met, the data can also be queried

• SQL Solution to injection attack

• Use PreparedStatement Precompiled performer object
• It will be performing sql The statement before , take sql Statement
• clear sql After statement format , It won't change
• The rest will be considered parameters
• sql The parameters in the statement use ? As placeholder
• by ? Placeholder assignment method
• setXxx( Parameters 1, Parameters 2);
• Xxx Representative data type
• Parameters 1：? Location number of ( Number from 1 Start )
• Parameters 2：? Actual parameters of
• Such as ：

• String sql="SELECT * FROM user WHERE loginname=? AND password=?";
  pstm = con.prepareStatement(sql);
  pstm.setString(1," Zhang San ");
  pstm.setString(2,"123456");

• perform sql sentence

• // Definition SQL sentence 
  String sql = "SELECT * FROM user WHERE loginname=? AND password=?";
  // Get the operation object , perform sql sentence , Get the result set 
  st = con.prepareStatement(sql);
  st.setString(1," Zhang San ");
  st.setString(2,"123456");
  rs = st.executeQuery();
  // Get the result set 
  if(rs.next()){
  ....... encapsulate 
  }