关于SQL漏洞注入(Ado.Net)

SQL漏洞注入是常见的一种攻击方式，我们可以通过一些简单的方式来预防。看一下我们经常写的代码：

1: /// <summary>

2: /// 不安全的登录代码

3: /// </summary>

4: /// <param name="sender"></param>

5: /// <param name="e"></param>

6: private void button2_Click(object sender, EventArgs e)

7: {

8:     string connString = "server=.;database=userinfo;uid=sa;pwd=123456";

9:     using (SqlConnection conn = new SqlConnection(connString))

10:     {

11:         conn.Open();

12:         string sql = string.Format("select * from userinfo where username = '{0}' and userpwd='{1}'", textBox1.Text, textBox2.Text);

13:         using (SqlCommand cmd = new SqlCommand(sql, conn))

14:         {

15:             using (SqlDataReader reader = cmd.ExecuteReader())

16:             {

17:                 if (reader.Read())

18:                 {

19:                     MessageBox.Show("Success!");

20:                 }

21:                 else

22:                 {

23:                     MessageBox.Show("Error");

24:                 }

25:             }

26:         }

27:     }

28: }

数据库的结构：





运行程序：





SQL漏洞注入：

方式一（知道用户名）：

当在用户名文本框中输入 tom ’ -- 点击登录按钮：





原因是生成后的SQL成了如下形式：

1: select * from userinfo where username = 'tom ' --' and userpwd=''

--是SQL中的注释

方式二（不知道用户名密码）：

当在用户名文本框中输入 ' or 1=1 -- 点击登录按钮：





生成后的SQL：

1: select * from userinfo where username = '' or 1=1 --' and userpwd=''

--依然是注释，但是or促成了1=1条件的永远成立。

 

预防方式一（使用带参数的SQl）：

1: /// <summary>

2: /// 安全登录

3: /// </summary>

4: /// <param name="sender"></param>

5: /// <param name="e"></param>

6: private void button3_Click(object sender, EventArgs e)

7: {

8:     try

9:     {

10:         string connString = "server=.;database=userinfo;uid=sa;pwd=123456";

11:         using (SqlConnection conn = new SqlConnection(connString))

12:         {

13:             conn.Open();

14:             string sql = "select * from userinfo where username = @id and userpwd= @pwd";

15:             using (SqlCommand cmd = new SqlCommand(sql, conn))

16:             {

17:                 cmd.Parameters.Add(new SqlParameter("@id", textBox1.Text));

18:                 cmd.Parameters.Add(new SqlParameter("@pwd", textBox2.Text));

19:                 using (SqlDataReader reader = cmd.ExecuteReader())

20:                 {

21:                     if (reader.Read())

22:                     {

23:                         MessageBox.Show("Success!");

24:                     }

25:                     else

26:                     {

27:                         MessageBox.Show("Error");

28:                     }

29:                 }

30:             }

31:         }

32:     }

33:     catch (Exception ex)

34:     {

35:         MessageBox.Show(ex.Message.ToString());

36:

37:     }

38: }

运行：







方式二（使用存储过程）：

存储过程：

1: create proc findUser

2: @name nvarchar(50),

3: @pwd nvarchar(50)

4: as

5: select * from userinfo where username = @name and userpwd = @pwd

代码：

1: /// <summary>

2: /// 安全登录

3: /// </summary>

4: /// <param name="sender"></param>

5: /// <param name="e"></param>

6: private void button3_Click(object sender, EventArgs e)

7: {

8:     try

9:     {

10:         string connString = "server=.;database=userinfo;uid=sa;pwd=123456";

11:         using (SqlConnection conn = new SqlConnection(connString))

12:         {

13:             conn.Open();

14:             using (SqlCommand cmd = new SqlCommand("finduser", conn))

15:             {

16:                 cmd.CommandType = CommandType.StoredProcedure;

17:                 cmd.Parameters.Add(new SqlParameter("@name", textBox1.Text));

18:                 cmd.Parameters.Add(new SqlParameter("@pwd", textBox2.Text));

19:                 using (SqlDataReader reader = cmd.ExecuteReader())

20:                 {

21:                     if (reader.Read())

22:                     {

23:                         MessageBox.Show("Success!");

24:                     }

25:                     else

26:                     {

27:                         MessageBox.Show("Error");

28:                     }

29:                 }

30:             }

31:         }

32:     }

33:     catch (Exception ex)

34:     {

35:         MessageBox.Show(ex.Message.ToString());

36:

37:     }

38: }

运行结果同上。