摘要
SQL注入攻击是一种利用客户端用户提交数据构成查询语句而没有对潜在有害字符进行处理就在Web应用后台数据库中执行,从而产生与应用预期不同结果的一种攻击手段。在Internet或企业内部网络中,对Web应用中进行SQL注入攻击大量存在。这种攻击手段很容易被攻击者利用,但是只要对Web应用采取合理的安全防护措施就可以阻止SQL注入的发生或减少攻击造成的损失。
SQL injection is a technique for exploiting the Web application that use client-supplied data for SQL queries and, without stripping potentially harmful characters, execute SQL queries in back-end database, thus producing an attack different from the expectation. In the Internet or intranet, remarkable numbers of SQL injections exist the Web application, which is easily exploited by attackers. However, proper countermeasures adopted in Web application could prevent SQL injections or reduce the loss resulted from the attacks.
出处
《信息安全与通信保密》
2010年第4期81-83,共3页
Information Security and Communications Privacy
