blocks|key|5279633|text|您可以通过不使用Direct+SQL而改为使用参数化查询和/或存储过程来防止这种情况。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5279634|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

You can prevent it by not using Direct SQL and using parameterised queries and/or Stored Procedures instead.

blocks|key|5279687|text|正则表达式是与SQL注入无关的(黑名单等从来都不是最强的方法)；然而，参数@Email的使用意味着(假设它仍然是参数化的)而不是易受SQL注入的影响。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|BOLD|entityRanges|data|5279688|SQL注入与输入的不适当连接有关；对抗它的主要工具是参数，这里已经发生了这种情况。|5279689|例如，如果您这样做：|5279690|var+sql+=+"SELECT+...snip...+WHERE+Email='"+%2B+email+%2B+"'";+//+BAD!!!!!|code-block|syntax|javascript|5279691|然后说很容易受到SQL注入的影响。通过使用参数，该值不会被视为查询的一部分，因此攻击者没有at攻击向量。|5279692|entityMap^0|11|6|1P|3|0|0|0|0|2|1|0^^$0|@$1|2|3|4|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|D]]|E|@]|F|$]]|$1|G|3|H|5|6|7|Y|8|@]|E|@]|F|$]]|$1|I|3|J|5|6|7|Z|8|@]|E|@]|F|$]]|$1|K|3|L|5|M|7|10|8|@]|E|@]|F|$N|O]]|$1|P|3|Q|5|6|7|11|8|@$9|12|A|13|B|D]]|E|@]|F|$]]|$1|R|3|-4|5|6|7|14|8|@]|E|@]|F|$]]]|S|$]]

A regex is unrelated to SQL injection (blacklisting etc is never the strongest approach); however, the use of the parameter <code>@Email</code> means (assuming it remains parameterised) that is not susceptible to SQL injection.

SQL injection relates to inappropriate concatenation of input; the main tool to fight it is parameters, which has already happened here.

For example, if you did:

<pre><code>var sql = "SELECT ...snip... WHERE Email='" + email + "'"; // BAD!!!!!
</code></pre>

then that is heavily susceptible to SQL injection. By using a parameter, the value is not treated as part of the query, so the attacker does not have at attack vector.

blocks|key|5279741|text|如果你使用参数化的值，你将会做的很好，你不能通过参数注入，只能通过连接的值。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5279742|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

If you use parameterised values, you are going to be fine regardless, you can not inject via parameters, only via concatenated values.

blocks|key|919905|text|Here是微软模式与实践小组对你的问题的回答。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|919906|一般来说，简单的规则是:不使用动态SQL生成，如果使用，则清理您的输入。|919907|不要只是连接字符串来构建SQL查询。如果需要在应用程序中自行构建查询，那么可以使用带参数的参数化SQL查询--这样做是安全的。|919908|下面是我提供上述链接的文档中的一个示例：|919909|++DataSet+userDataset+=+new+DataSet();
++SqlDataAdapter+myCommand+=+new+SqlDataAdapter(+
+++++++++++++"LoginStoredProcedure",+connection);
++myCommand.SelectCommand.CommandType+=+CommandType.StoredProcedure;
++myCommand.SelectCommand.Parameters.Add("@au_id",+SqlDbType.VarChar,+11);
++myCommand.SelectCommand.Parameters["@au_id"].Value+=+SSN.Text;

++myCommand.Fill(userDataset);|code-block|syntax|javascript|919910|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/ff648339.aspx^0|0|4|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|11|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|12|8|@]|9|@]|C|$]]|$1|J|3|K|5|L|7|13|8|@]|9|@]|C|$M|N]]|$1|O|3|-4|5|6|7|14|8|@]|9|@]|C|$]]]|P|$Q|$5|R|S|T|C|$U|V]]]]

<a href="http://msdn.microsoft.com/en-us/library/ff648339.aspx" rel="nofollow">Here</a> is the reply from Microsoft Pattern &amp; Practices group to your question.

In general, the simple rule is: not to use dynamic SQL generation and if you do, sanitize your input.

Never just concatenate strings for building your SQL query. If you need to build a query on your own in your application, then use parametrized SQL queries with parameters -- this way you are on a safe side.

Here is an example from the document I provide the link to above:

<pre><code> DataSet userDataset = new DataSet();
 SqlDataAdapter myCommand = new SqlDataAdapter( 
 "LoginStoredProcedure", connection);
 myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;
 myCommand.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11);
 myCommand.SelectCommand.Parameters["@au_id"].Value = SSN.Text;

 myCommand.Fill(userDataset);
</code></pre>

blocks|key|5279804|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5279805|Use+parameterised+|ordered-list-item|5279806|Encode+your+|5279807|5279808|entityMap^0|0|0|0|0^^$0|@$1|2|3|-4|4|5|6|I|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|J|7|@]|8|@]|9|$]]|$1|D|3|E|4|C|6|K|7|@]|8|@]|9|$]]|$1|F|3|-4|4|5|6|L|7|@]|8|@]|9|$]]|$1|G|3|-4|4|5|6|M|7|@]|8|@]|9|$]]]|H|$]]

<ol>
<li>Use parameterised values</li>
<li>Encode your strings</li>
</ol>

For email entry in a text box by the user i am doing client side check, to find whether the email is valid or not

<pre><code> string emailexist = "SELECT COUNT(DISTINCT UserID) as count FROM tbl_user WHERE Email=@Email "; 


 &lt;asp:RegularExpressionValidator ID="RegularExpressionValidator2" ValidationGroup="Login" ControlToValidate="txtUserName"
 ValidationExpression="\w+([-+.]\w+)*@\w+([-.]\w+)*\.\w+([-.]\w+)*" CssClass="Error"
 runat="server" /&gt;
</code></pre>

is this regular expression good enough to prevent sql injection for email.

Other Text:

<pre><code> string groupExistQuery = "SELECT COUNT(DISTINCT GroupID) as count FROM tbl_group WHERE GroupName=@GroupName"; 
</code></pre>

I am doing a query in server side to check whether the group name entered by the user is already available in the database, there is a strong possibility to perform sql injection here. How should I prevent from it.

how to prevent SQL Injection in a asp.net website

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

对于用户在文本框中输入的电子邮件，我正在进行客户端检查，以确定电子邮件是否有效 string emailexist = "SELECT COUNT(DISTINCT UserID) as count FROM tbl_user WHERE Email=@Email "; <asp:RegularExpre...

问如何防止asp.net网站中的SQL注入
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何防止asp.net网站中的SQL注入EN