解决SQL注入漏洞方法

防止通过参数传不安全值，必须使用参数化的预编译查询语句

 String custname = request.getParameter("customerName"); // This should REALLY be validated too
 // perform input validation to detect attacks
 String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";
 
 PreparedStatement pstmt = connection.prepareStatement( query );
 pstmt.setString( 1, custname); 
 ResultSet results = pstmt.executeQuery( );

 2，输入参数白名单

不建议将SQL语句关键部分作参数传递，如表名、字段名或排序符（ASC、DESC）等。建议设计通过标识来判断，如以下例子

 String tableName;
 switch(PARAM):
   case "Value1": tableName = "fooTable";
                  break;
   case "Value2": tableName = "barTable";
                  break;
     ...
   default      : throw new InputValidationException("unexpected value provided for table name");

public String someMethod(boolean sortOrder) {
 
 String SQLquery = "some SQL ... order by Salary " + (sortOrder ? "ASC" : "DESC");
 ...

解决SQL注入漏洞方法

标签：break   cti   建议   ack   rest   cep   des   class   语句