摘要
针对Web网站突出的安全问题,详细分析了当前对Web网站安全威胁最严重的3种网络攻击:SQL注入、跨站和跨站请求伪造的实现原理和常用攻击方法,并结合研究和实践提出了具体的防范算法:采用过滤用户提交Web请求中的非法字符串代码实现了SQL注入及跨站的防范算法,具体代码使用了JSP中的Servlet过滤器实现;采用伪随机数对用户端身份进行持续认证的方式实现了跨站请求伪造算法。
For the prominent safety issue of the website, the paper analyzes in depth the three most serious attacks against the website security, that is, SQL injection, cross-site scripting, and cross-site request forgery. In combination of study and practice, an anti-attack algorithm against SQL injection and cross-site scritpting by filtering out the illegal string code from the requests of the website user is proposed, the servlet filter in JSP is employed to realize the specific code, while an anti-attack algorithm against cross-site request forgery by using pseudo-random number to continuously authenticate the user also presented.
出处
《信息安全与通信保密》
2010年第10期92-94,共3页
Information Security and Communications Privacy
关键词
SQL注入
跨站
跨站请求伪造
安全代码
SQL injection
cross-site scripting
cross-site request forgery
safety code
