且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

如何美元,用户生成的SQL查询p $ pvent SQL注入

更新时间:2022-11-28 17:16:00

好了,你已经有足够多的人告诉你的。不要把做,所以如果他们无法劝阻你,这里有一些想法:

Well, you already have enough people telling you "dont' do this", so if they aren't able to dissuade you, here are some ideas:

提供良好的,不要试图排除不良结果
(我认为正确的术语白名单 VS 黑名单
到那个,我的意思的不看邪恶的或无效的东西折腾了的(有太多的方面,它可以书面或变相),而不是寻找的有效的东西,包括和折腾出一切。

INCLUDE the Good, Don't try to EXCLUDE the bad
(I think the proper terminology is Whitelisting vs Blacklisting ) By that, I mean don't look for evil or invalid stuff to toss out (there are too many ways it could be written or disguised), instead look for valid stuff to include and toss out everything else.

您已经在另一评论提到,你正在寻找用户友好的表名的列表,而代以实际模式表名。这就是我所说的 - 如果你要做到这一点,然后用字段名做,太

You already mentioned in another comment that you are looking for a list of user-friendly table names, and substituting the actual schema table names. This is what I'm talking about--if you are going to do this, then do it with field names, too.

我仍然在朝着某种形式的图形用户界面倾斜,虽然:选择表格,查看这里,你想看到这里选择字段,用一些下拉菜单来建立一个where子句,等等。一个痛苦,但仍可能更容易。

I'm still leaning toward a graphical UI of some sort, though: select tables to view here, select fields you want to see here, use some drop-downs to build a where clause, etc. A pain, but still probably easier.