blocks|key|1399995|text|我发现这篇文章是关于SQL注入技术的非常好的读物(链接指向PDF)：Advanced+SQL+Injection+In+SQL+Server+Applications。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1399996|尽管标题上写着"Advanced"，但即使您对SQL注入了解不多，它的可读性也很强。|1399997|entityMap|0|LINK|mutability|MUTABLE|url|http://www.cgisecurity.com/lib/advanced_sql_injection.pdf^0|Y|1D|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

I found this paper to be an extremely good read about SQL injection techniques (link is to PDF): <a href="http://www.cgisecurity.com/lib/advanced_sql_injection.pdf" rel="nofollow noreferrer">Advanced SQL Injection In SQL Server Applications</a>.

Despite the title saying "Advanced", it's quite readable even if you don't have much knowledge about SQL injection.

blocks|key|1400059|text|要获得一些大致的背景知识，请查看Wikipedia+article+on+SQL+Injection。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1400060|简而言之，SQL注入攻击会使您很容易受到数据库数据失窃和破坏的威胁。可以对系统执行哪些操作的确切详细信息取决于系统本身的详细信息。|1400061|任何时候，只要将用户的输入传递到数据库，就会有一个潜在的注入点。Web应用程序通常在这方面缺乏这方面的能力，因为新程序员通常不了解处理用户输入的风险，并且web应用程序受到非常聪明的人的攻击，您从未想过会发现您的程序。|1400062|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/SQL_Injection^0|G|Y|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

To get some general background check out the <a href="http://en.wikipedia.org/wiki/SQL_Injection" rel="nofollow noreferrer">Wikipedia article on SQL Injection</a>.

In short SQL injection attacks can leave you vulnerable to all manor of database data theft and destruction. The exact details of what can be done to your system depend on the details of the system itself.

Any time you pass input from your users to your database you have a potential injection point. Web applications are often lacking in the this regard, as new programmers often do not understand the risks of handling input from users, and web applications are attacked by very smart people you never thought would find your program.

blocks|key|1400138|text|注入SQL的点是应用程序接受用户输入的任何点。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1400139|这是否会成为web应用程序的危险漏洞，取决于此输入稍后是否被用作SQL查询的一部分，而没有正确检查其类型并在必要时对其进行转义。|1400140|如果没有正确的转义，用户“注入”的一些SQL代码可能会被SQL引擎执行为SQL代码，而不是简单的字符串或值。|1400141|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

The point where SQL is injected is any point that your application accepts input from the user.

Whether this becomes a dangerous vulnerability for your web application depends on whether this input is later used as part of an SQL query without properly checking its type and escaping it if necessary.

Without proper escaping, some SQL code 'injected' by the user could be executed by the SQL engine as SQL code, rather than a simple string or value.

blocks|key|1614938|text|当应用程序的用户能够影响数据库查询的意义时，就会发生SQL注入。当连接来自用户输入的任意字符串以创建SQL并将其提供给数据库时，通常会发生这种情况。例如，假设我们有以下代码(用PHP编写，但同样适用于任何语言)，可以用来处理用户登录。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1614939|$sql+=+"SELECT++FROM+users+WHERE+username='".$_GET['username']."'+AND+password='".$_GET['password']."'";|code-block|syntax|javascript|1614940|当用户输入以下内容时，就会造成危害|1614941|administrator';+--|1614942|..。作为用户名。如果没有正确的编码，查询将变成：|1614943|SELECT+*+FROM+users+WHERE+username='administrator';+--+AND+password=''|1614944|这里的问题是，username中的‘关闭了username字段，然后--启动了一个SQL注释，导致数据库服务器忽略字符串的其余部分。最终结果是，用户现在可以以管理员身份登录，而不必知道密码。SQL+Inection还可用于执行UPDATE、DELETE或DROP查询并真正损坏数据库。|1614945|可以通过使用参数化查询或应用您的语言/工具包的转义函数(例如PHP中的mysql_real_escape_string()+)来防止SQL注入。|1614946|一旦你理解了SQL注入，你就会明白this+cartoon背后的笑话。|offset|length|1614947|entityMap|0|LINK|mutability|MUTABLE|url|http://xkcd.com/327/^0|0|0|0|0|0|0|0|0|H|C|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|15|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|16|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|17|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|18|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|19|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1B|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|1C|8|@]|9|@$U|1D|V|1E|1|1F]]|A|$]]|$1|W|3|-4|5|6|7|1G|8|@]|9|@]|A|$]]]|X|$Y|$5|Z|10|11|A|$12|13]]]]

SQL Injection occurs when the user of an application is able to affect the meaning of database query. This often occurs when arbitary strings from user input are concatenated to create SQL which is fed to the database. For example lets say we had the following code (in PHP, but the same holds true for any language), which might be used to handle a user login.

<pre><code>$sql = "SELECT FROM users WHERE username='".$_GET['username']."' AND password='".$_GET['password']."'";
</code></pre>

The harm is done when the user enters something like 

<pre><code>administrator'; --
</code></pre>

... for the username. Without proper encoding the query becomes:

<pre><code>SELECT * FROM users WHERE username='administrator'; -- AND password=''
</code></pre>

The issue here is that the ' in the username closes out the username field then the -- starts a SQL comment causing the database server to ignore the rest of the string. The net result is the user can now log in as the administrator without having to know the password. SQL Inection can also be used to execute UPDATE, DELETE or DROP queries and really damage the database.

SQL Injection can be prevented by using parameterised queries, or applying your language/toolkit's escaping functions (such as mysql_real_escape_string() in PHP).

Once you understand SQL Injection you'll get the joke behind <a href="http://xkcd.com/327/" rel="noreferrer">this cartoon</a>.

blocks|key|1614987|text|SQL注入是恶意用户将SQL放入输入字段以尝试在您的服务器上运行SQL的地方。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1614988|我坚持的第一个建议是使用参数化的存储过程，而不是在代码中构建原始SQL。|1614989|存储过程参数不会被执行，这使得它们在大多数情况下是安全的。|1614990|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

SQL injection is where a malicious user will put SQL into input fields to try and run the SQL on your server.

The #1 advice that I adhere to is to use parameterized stored procedures rather than building raw SQL in code.

Stored Procedure parameters don't get executed, making them safe in most cases.

blocks|key|1615041|text|SQL注入是指本应是数据的东西被不情愿地当作SQL代码处理。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1615042|例如，如果您要执行以下操作|1615043|mysql_query("SELECT+*+FROM+posts+WHERE+postid=$postid");|code-block|syntax|javascript|1615044|通常，它会为您提供具有给定id的post，但是假设$postid被设置为字符串10;+DROP+TABLE+posts+--；突然之间，您发送的实际查询是|offset|length|style|CODE|1615045|mysql_query("SELECT+*+FROM+posts+WHERE+postid=10;+DROP+TABLE+posts+--");|1615046|这是一个相当大的问题，因为你会因为一个恶意用户而丢失整个posts表--哦，天哪。|1615047|防止这种情况的最简单方法是使用预准备语句，例如通过PDO或MySQLi。|1615048|PDO中的等效示例将是|1615049|$statement+=+$db->prepare('SELECT+*+FROM+posts+WHERE+postid+=+:postid');
$statement->bindValue(':postid',+$postid);
$statement->execute();|1615050|这样做可以确保数据库系统知道$postid将被视为数据而不是代码，因此将得到适当的处理。|1615051|entityMap|0|LINK|mutability|MUTABLE|url|http://dk2.php.net/manual/en/pdo.prepare.php|1|http://dk2.php.net/manual/en/mysqli.prepare.php^0|0|0|0|P|7|13|N|0|0|0|P|3|0|T|6|1|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1A|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|1B|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|1C|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|1D|8|@$K|1E|L|1F|M|N]|$K|1G|L|1H|M|N]]|9|@]|A|$]]|$1|O|3|P|5|F|7|1I|8|@]|9|@]|A|$G|H]]|$1|Q|3|R|5|6|7|1J|8|@]|9|@]|A|$]]|$1|S|3|T|5|6|7|1K|8|@]|9|@$K|1L|L|1M|1|1N]|$K|1O|L|1P|1|1Q]]|A|$]]|$1|U|3|V|5|6|7|1R|8|@]|9|@]|A|$]]|$1|W|3|X|5|F|7|1S|8|@]|9|@]|A|$G|H]]|$1|Y|3|Z|5|6|7|1T|8|@]|9|@]|A|$]]|$1|10|3|-4|5|6|7|1U|8|@]|9|@]|A|$]]]|11|$12|$5|13|14|15|A|$16|17]]|18|$5|13|14|15|A|$16|19]]]]

SQL injection is when things that're supposed to be data are treated as SQL code unwillingly.

For instance, if you were to do

<pre><code>mysql_query("SELECT * FROM posts WHERE postid=$postid");
</code></pre>

Normally it'd get you the post with a given id, but assume that <code>$postid</code> is set to the string <code>10; DROP TABLE posts --</code>; all of a sudden, the actual query you're sending is

<pre><code>mysql_query("SELECT * FROM posts WHERE postid=10; DROP TABLE posts --");
</code></pre>

This is quite a problem, as you'd be losing your entire posts table due to a malicious user - oh dear.

The easiest way to prevent this is to use prepared statements, for instance through <a href="http://dk2.php.net/manual/en/pdo.prepare.php" rel="noreferrer">PDO</a> or <a href="http://dk2.php.net/manual/en/mysqli.prepare.php" rel="noreferrer">MySQLi</a>.

The equivalent example in PDO would then be 

<pre><code>$statement = $db-&gt;prepare('SELECT * FROM posts WHERE postid = :postid');
$statement-&gt;bindValue(':postid', $postid);
$statement-&gt;execute();
</code></pre>

Doing this ensures that the database system knows that $postid is to be treated as data and not code, and will thus be handled appropriately.

Can someone explain SQL injection? How does it cause vulnerabilities? Where exactly is the point where SQL is injected?

What is SQL injection?

有人能解释一下SQL注入吗？它是如何导致漏洞的？SQL的注入点到底在哪里？

问什么是SQL注入？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问什么是SQL注入？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问什么是SQL注入？
EN