Web项目中的SQL注入问题研究与防范方法_王云.pdfVIP

( ) 计算机工程与设计 Computer Engineering and Design 976 2010,31 5 计算机工程与设计 Computer Engineering and Design 信息安全技术 Web 项目中的SQL 注入问题研究与防范方法 王 云， 郭外萍， 陈承欢 (湖南铁道职业技术学院信息系，湖南株洲4 12001) 摘 要：基于B/S 模式的网络服务构架技术的应用被普遍采用，许多该类型的应用程序在设计与开发时没有充分考虑到数据 合法性校验问题，因此使其在应用中存在安全隐患。在横向比较SQL 注入攻击模式的基础之上，分析了SQL 注入攻击的特 点、原理，并对常用注入途径进行了总结。提出在主动式防范模型的基础上，使用输入验证、SQL Server 防御以及使用存储过 程替代参数化查询相结合的形式构建出一种有效防范 SQL 注入攻击的思路和方法。测试结果表明该防范模型具有较高的 实用性和安全性。 关键词：SQL; SQL 注入攻击; 防范模型; 执行模块; 防范方法; SQL server 防御 中图法分类号：TP393.08 文献标识码：A 文章编号：1000-7024 (2010) 05-0976-03 Research on SQL inj ection attacks and guard method in web proj ect WANG Yun, GUO Wai-ping, CHEN Cheng-huan (Department of Computer Science, Hunan Railway Professional Technology College, Zhuzhou 4 12001, China) Abstract ：In recent years, with the based on B/S mode network service framework technology is widely adopted by many software ap- plications. Many this type application procedures when designs and the development has not considered the data validity verification question fully, therefore causes it to have the safe hidden danger in the application. Based of horizontal comparison SQL inj ection attack mode, the characteristic and the theory of SQL inj ection attacks are analyzed, and the commonly used way of SQL inj ection attacks is summarized. Based on proactive prevention model combined input validation, SQL server defense with using stored procedure instead of parameterized queries to build up an effective guard against SQL inj ection attacks ideas and methods. The test shows that the preventive model has a high availability and security. Key words ：SQL; SQL inj ection attacks; guard model; execution module; guard method; SQL server defense