er的WEB应用程序注入攻击介绍.doc

基于SQL Server的WEB应用程序注入攻击介绍
常志东曲楠楠
(烟台南山学院软件工程学院,山东烟台,265713)
摘要:由于网页制作者水平和经验的不足,很多网页中存在着不安全的因素,这就给网页本身以及系统造成了潜在的威胁。特别是一些需要接受输入内容的网页,这种威胁就更加明显,攻击者可能会利用向数据库服务器发送一段包含特殊字符的查询语句,来骗取数据库服务器执行该语句,然后根据返回的出错信息获得想要数据,进而对数据库进行进一步的危险操作,以此来破坏数据库的完整性;因此预防与禁止这些操作就显得极为重要。
关键词:sql注入;sql 注入攻击;asp+sql server; 防范。
中图分类号:TP31 文献标志码:B
The introduction of injection in web application that based on sql server attacking
CHANG Zhi-dong QU Nan-nan
School of Software Engineer,,Yantai Nanshan University,Yantai,Shandong 265713
Abstract: Because of the website maker level and experience's insufficiency, many websites have the unsafe factors, it brings on the latent threat in website itself as well as the system. Especially some websites which need to accept an importable contents, this kind of threat more obvious, the aggressor may make use of toward database server to send out a SQL statement which includes special characters , to cheat database server to carry out that, then according to returned erroneous information to get data that it want, then carry on a further dangerous operation to the database, to break the integrity of database with this. So it seems that it is extremely important to prevent and forbid these operations.
Keywords: sql injection;sql injection attack;asp+sql server;defence。
随着B/S(浏览器/服务器)模式应用开发的发展,使用此种模式编写应用程序的程序员越来越多。但是由于这个行业的入门门槛不高,程序员的水平及经验也参差不齐,相当大一部分程序员在编写代码的时候,没有考虑到