[패턴문자]
' |
union |
" |
select |
– |
insert |
# |
drop |
( |
update |
) |
from |
; |
where |
@ |
join |
= |
substr (oracle) |
* |
user_tables
(oracle) |
/ |
user_table_columns
(oracle) |
+ |
subsring
(ms-sql) |
information_schema
(mysql) |
sysobjects
(ms-sql) |
table_schema
(mysql) |
declare (ms-sql)
|
/* |
*/ |
&& |
openrowset |
xp_ |
or |
and |
% |
- 패턴 문자 필터링
- 언어별 디버깅 모드시 상세한 에러출력 금지(사용자 정의 에러 사용 권장)
JSP SQL Injection 시큐어 코딩
page.jsp 파일에서
String param = request.getParameter('field');
Pattern PreventChar = Pattern.compile("['\"\\-#()@;=*/+]"); String filteredData = PreventChar.matcher(param).replaceAll("");
OR
String[] PreventChars = {"'","\""...} //위 표에 있는 데이터 나열함.
for (int i=0; i< PreventChars.length; i++) { if(param.indexOf(PreventChars[i]) != -1){ System.out.println("금지된 키워드 사용입니다."); return false; } }
db.jsp 파일에서
PreparedStatement stmt =
conn.prepareStatement( "select
* from table where field1=? and field2=?" );
stmt.setString( 1 ,
value1);
stmt.setString( 2 ,
value2);
ResultSet rs = stmt.executeQuery();
PHP
SQL Injection 시큐어 코딩
page.php파일에서
$param = $_POST['field'] or $_GET['field'];
$filtereddata = htmlspecialchars($param); $filtereddata = strip_tags($filtereddata); $filtereddata = mysql_real_escape_string($filtereddata);
OR
$PreventChars = array("'","\""...); //위 표에 있는 데이터 나열함.
foreach($PreventChars as $keyword){ $param = str_replace($keyword,"",$param); }
db.php파일에서 $value =$filtereddata;
$sth =
$dbh->prepare('select field1, field2...from table where
field1 = :field1');
$sth->bindValue(':field1',$value,PDO:PARAM:STR,10);
$sth->execute();
ASP.NET
(C#) 시큐어 코딩(MSDN 참조)
page.aspx 중에서
<%@ language="C#" %>
<form id="form1" runat="server">
<asp:TextBox ID="SSN"
runat="server"/>
<asp:RegularExpressionValidator
ID="regexpSSN"
runat="server"
ErrorMessage="Incorrect SSN Number"
ControlToValidate="SSN"
ValidationExpression="^\d{3}-\d{2}-\d{4}$" />
</form>
page.apsx.cs 중에서
if (Regex.IsMatch(Request.Cookies["SSN"], "^\d{3}-\d{2}-\d{4}$"))
{
// access the database
}
else
{
// handle the bad input
}
using System;
using System.Text.RegularExpressions;
public void CreateNewUserAccount(string name, string password)
{
// Check name contains only lower case
or upper case letters,
// the apostrophe, a dot, or white
space. Also check it is
// between 1 and 40 characters long
if ( !Regex.IsMatch(userIDTxt.Text,
@"^[a-zA-Z'./s]{1,40}$"))
throw new
FormatException("Invalid name format");
// Check password contains at least one
digit, one lower case
// letter, one uppercase letter, and is
between 8 and 10
// characters long
if ( !Regex.IsMatch(passwordTxt.Text,
@"^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,10}$" ))
throw new
FormatException("Invalid password format");
// Perform data access logic (using type
safe parameters)
...
}
db.cs 파일에서 using System.Data; using System.Data.SqlClient;
using (SqlConnection connection = new SqlConnection(connectionString)) { DataSet userDataset = new DataSet(); SqlDataAdapter myCommand = new SqlDataAdapter( "LoginStoredProcedure", connection); myCommand.SelectCommand.CommandType = CommandType.StoredProcedure; myCommand.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11); myCommand.SelectCommand.Parameters["@au_id"].Value = SSN.Text;
myCommand.Fill(userDataset); }
[참고사이트]
https://msdn.microsoft.com/en-us/library/ff648339.aspx
|