■
导航SEO首页>>网站建设>>程序开发>>防止用'or''=''or'登陆后台
■
防止用'or''=''or'登陆后台现在很多的公司网站的后台漏洞是大的叫人害怕
只要写入'or' '='，
就可以顺利的登入它的后台管理
针对于此，大家都是如和处理的？
希望各位发出自己的检验，完善下这个帖子，
PS：为安全做点力量
我本着抛砖引玉思想欢迎大家来一起讨论此帖，谢谢！
此帖已经在远望论坛发帖子讨论,已经有人回复总结一文,在此一起发出,希望更多的人针对此发表自己的见解
针对ASP中SQL Injection的初级防护（总结版）
记得大约是在2002年的时候，SQL Injection（SQL注入）开始有了最初的雏形。黑客们发现，在动态网页的某些地方（表单等……）插入一些可以在数据库查询中起作用的语句和符号，就可以让页面执行后，返回特殊的结果。于是，经过了2003的发展，到2004年，SQL Injection已经作为一种很成熟的入侵技术登上了安全界的舞台。也是2004年，有大批的网站程序被发现了SQL Injection漏洞，也有大批的网站栽倒在这种攻击手段之下。
下面，我就小行和逍遥一指令的帖子，作总结性的说明，仅供参考。
正如如小行所说的，在某些网站的登录界面，如果你知道了存在的用户名（例如：admin），你无须知道密码。只需在密码框中输入' or ''='即可。（注意，全是单引号！）这样在不知道密码的情况下，也可以用admin的身份登录。
但是，我想说的是，' or ''='在一些地方会出现问题。有些数据库不会认为“空”＝“空”是成立的条件，这样就不行了。最好写成' or '1'='1
这样，SQL的查询语句，就变成了如下的样子。
select * from users where name='admin' and pass='123456' or '1'='1'
上面，蓝色的部分是用户在密码框中输入的数据。大家可以看见，由于用户的巧妙构造，使得SQL Server把这条查询语句解析为3个条件：
伊图教程网[www.etoow.com]
http://www.etoow.com/html/2007-08/1186665369.html
1、name='admin'
只要写入'or' '='，
就可以顺利的登入它的后台管理
针对于此，大家都是如和处理的？
希望各位发出自己的检验，完善下这个帖子，
PS：为安全做点力量
我本着抛砖引玉思想欢迎大家来一起讨论此帖，谢谢！
此帖已经在远望论坛发帖子讨论,已经有人回复总结一文,在此一起发出,希望更多的人针对此发表自己的见解
针对ASP中SQL Injection的初级防护（总结版）
记得大约是在2002年的时候，SQL Injection（SQL注入）开始有了最初的雏形。黑客们发现，在动态网页的某些地方（表单等……）插入一些可以在数据库查询中起作用的语句和符号，就可以让页面执行后，返回特殊的结果。于是，经过了2003的发展，到2004年，SQL Injection已经作为一种很成熟的入侵技术登上了安全界的舞台。也是2004年，有大批的网站程序被发现了SQL Injection漏洞，也有大批的网站栽倒在这种攻击手段之下。
下面，我就小行和逍遥一指令的帖子，作总结性的说明，仅供参考。
正如如小行所说的，在某些网站的登录界面，如果你知道了存在的用户名（例如：admin），你无须知道密码。只需在密码框中输入' or ''='即可。（注意，全是单引号！）这样在不知道密码的情况下，也可以用admin的身份登录。
但是，我想说的是，' or ''='在一些地方会出现问题。有些数据库不会认为“空”＝“空”是成立的条件，这样就不行了。最好写成' or '1'='1
这样，SQL的查询语句，就变成了如下的样子。
select * from users where name='admin' and pass='123456' or '1'='1'
上面，蓝色的部分是用户在密码框中输入的数据。大家可以看见，由于用户的巧妙构造，使得SQL Server把这条查询语句解析为3个条件：
伊图教程网[www.etoow.com]
http://www.etoow.com/html/2007-08/1186665369.html
2、pass='123456'
3、'1'='1'
关键是中间的那个or，这样一来，SQL Server在解析的时候，只要条件2、3，符合一个就可以了。
因为1＝1是衡成立的，所以这个查询的结果肯定是true。
既然已经知道了原理，那我们可以试着防范这种攻击。
我们的根本目标，就是把用户输入的单引号和or过滤掉，这样就能在基本上杜绝SQL Injection攻击。但是，需要强调的是，SQL语句中，起作用的还有and，分号，--（两个减号）等等。
解释一下：and用于连接两个条件。;（分号）用于分隔两个语句。（如果把两个语句写在一行，就需要它。）--（双减号只在MS SQL Server中起作用，含义是忽略后面的内容。这个通常在繁琐的MS SQL注入中使用。）
回归主题。asp中为我们提供的字符转义函数：Replace。看代码：
<%
Dim Usr,Pwd
Usr=Request.form("username") '从表单获得数据
Pwd=Request.form("password") '同上
if (Usr<>"") and (Pwd<>"") then '判断数据为非空
Usr=Replace(Replace(Usr,"'",""),"or","") '嵌套了两个replace函数，过滤特殊字符
Pwd=Replace(Replace(Pwd,"'",""),"or","")
end if
%>
3、'1'='1'
关键是中间的那个or，这样一来，SQL Server在解析的时候，只要条件2、3，符合一个就可以了。
因为1＝1是衡成立的，所以这个查询的结果肯定是true。
既然已经知道了原理，那我们可以试着防范这种攻击。
我们的根本目标，就是把用户输入的单引号和or过滤掉，这样就能在基本上杜绝SQL Injection攻击。但是，需要强调的是，SQL语句中，起作用的还有and，分号，--（两个减号）等等。
解释一下：and用于连接两个条件。;（分号）用于分隔两个语句。（如果把两个语句写在一行，就需要它。）--（双减号只在MS SQL Server中起作用，含义是忽略后面的内容。这个通常在繁琐的MS SQL注入中使用。）
回归主题。asp中为我们提供的字符转义函数：Replace。看代码：
<%
Dim Usr,Pwd
Usr=Request.form("username") '从表单获得数据
Pwd=Request.form("password") '同上
if (Usr<>"") and (Pwd<>"") then '判断数据为非空
Usr=Replace(Replace(Usr,"'",""),"or","") '嵌套了两个replace函数，过滤特殊字符
Pwd=Replace(Replace(Pwd,"'",""),"or","")
end if
%>
内容来源：EX工作室-SEO资料站
浏览次数：0
ex 发布于 2008-1-26
浏览次数：0
ex 发布于 2008-1-26
■
评论内容| 1、 应该是零三年吧,当时元旦. 免费网络游戏 来临,学校要举办晚会,像我这种事. 免费游戏 事都不关心的人. 免费游戏下载 抱着这种心态. 魔兽 你们搞吧,搞吧,搞得好就去看下. 网络游戏 不好的话,还是还是睡觉实惠些. 网游 但后来还是感谢. 游戏 自己当时的冲动,跑去看了. 游戏下载 就看到了我的那位同学. 在线游戏 抱着把吉他. 战神不败 穿着白衣蓝裤的. 最新免费网络游戏 微闭着双眼. 最新网络游戏 轻启朱唇,一字一字. 最新网游 的从他的嘴时吐了. 最新游戏 出来,然后随着琴弦. 的颤动,美妙的. 东西就汩汩而出了. 游客 评论于 2008-12-5 |
| 2、 Perhaps our favourite. billig wow gold of all the improvements which LOTRO. buy world of warcraft gold makes to the genre as a whole, however, is. buying wow goldthe game's efforts to tackle. günstig wow gold the MMOG grind. HDRO gold Now, we've never seen. level wow an MMOG without grind of. lord of rings online gold some description, and LOTRO is no exception. lotro gold there will be plenty. lotro gold of occasions when you just run. lotro gold around killing oodles of identikit monsters. power level in order to gain money or. power leveling experience. power leveling However, the. wow billig gold introduction of the. wow gold kauf game's virtues and titles. wow level system simultaneously lightens. wow leveling the burden. wow lvl of grind, and introduces. wow lvl much-needed variety. wow lvl 70 to the character classes. wow po In essence, this system allows. wow power leveling you to earn "titles" by. wow powerlevel completing various deeds - a bit. wow powerleveling like Xbox Live Achievements, if you will. wowgold So while these aren't doled out. as quests, per se, there are. a bunch of things. you can do which will. earn you various different. titles, which you can. apply to your name in the. game to show off how ace you. are at a specific part of the game. . 游客 评论于 2008-12-5 |
| 3、 No MMORPG is ever truly free of the perils of lag either. buy cheap wow gold Again, full release. cheap wow power leveling Of course, the elephant world of online RPGs. des po wow Can LOTRO seriously . free online games Well the answer is: it doesn't really have to. free online war games Yes they're both MMORPGs, down at. gold wow the more of the market, but LOTRO. gold wow has its own corner of the MMORPG. mp3 player realm firmly staked out and. online games if pre-orders numbers. play war games are anything to go by, a massive. po wow European community of Tolkien. power level fans just itching to play. world of warcraft The truth is, LOTRO is more. world of warcraft than good enough to. wow europe stand on its own two furry hobbit feet. wow geld So, we come to the end. wow gold guide of this review's sojourn in. wow gold guide Middle-earth and we have to. wow gold verkaufen conclude that with. wow level service looks that would make an Elven maiden blush, married. wow leveling service with a compelling and authentic game world. wow lvl 60 based on the single most popular fantasy. wow powerlevel universe of all time, LOTRO. wow powerleveling guide has all the qualities necessary. wow powerleveling guide to make it a big big success. 游客 评论于 2008-12-5 |
| 4、 The good news, then, is that. 8GB MP3 PLAYER anyone who has played. apple ipod WoW - and, frankly, anyone who has. canon digital camera played any PC role-playing. cheap world of warcraft gold title in the last ten years - will be. digital camera able to dive straight into. digital cameras Middle-Earth and start. dvd player accomplishing things, with remarkably little in. eve isk the way of an initial learning curve to scale. ipod The better news is that LOTRO. ipod nano doesn't rest on WoW's laurels. ipod shuffle not by any means. ipod touch The real triumph of this game. ipods is that it takes many ideas which people. mp3 will be familiar with from WoW and improves upon. mp3 player them significantly. mp3 players If the MMOG gameplay. mp4 encountered by millions. portable dvd players of players in WoW is vanilla. world of warcraft buy gold ice-cream, this is Ben & Jerry's Cherry Garcia. wow There are more flavours, more complexity. wow gold more chunky bits - but you. wow gold can still eat. wow leveling it with the same spoon, and with. wow powerleveling little additional training learning curve. zubehoer mp3 player The introduction. to the game is a perfect example. Each of the races has. a unique introduction sequence which. sees you taking part in a heavily scripted. mission - be it rescuing Hobbits. from a Nazgul raid, or defending an. . 游客 评论于 2008-12-5 |
| 5、 That much is certainly undeniable. 2GB MP3 PLAYER LOTRO is very, very pretty. 4GB MP3 PLAYER It's far and away the most graphically. buy wow gold accomplished MMOG we've played to date, and playing. buying gold world of warcraft with the high definition client for th. cell phones game offers lighting, models. cheap cell phones and environments which. cheap wow gold really tick all the boxes for this. cheap wow gold kind of experience. cheap wow gold Detailed, Check. cheapest wow gold Varied, Check. eve isk Dramatic. mp3 players Check and double-check. phones cell Surprisingly enough, the game's visuals don't. portable mp3 player take as much of a toll on your. portable mp3 players hardware as you might anticipate. sell wow gold Our test system is an Athlon 64 X2 4800. world of warcraft gold with an ATI Radeon X1950. wow Pro card, which sits somewhere. wow gold in the mid-range of PC systems produced. wow gold in the last year or so, and LOTRO runs. wow gold comfortably at settings a few. wow gold notches down from the top. wow gold The lovely environmental effects still. wow gold look great, and even the busy, bustling. wow gold kaufen towns in the game. wow gold kaufen don't hammer the framerate down too badly. 魔兽战争网游下载 Much of the credit for the. 战神不败网游下载 visuals goes not to the technical accomplishments. of the game, however. LOTRO boasts almost uniformly. excellent artwork, and it is this - the. 游客 评论于 2008-12-5 |
■
签写评论■
友情链接