Technology sharing

한어Русский языкEnglishFrançaisIndonesianSanskrit日本語DeutschPortuguêsΕλληνικάespañolItalianoSuomalainenLatina

Ut cognoscas an notitia usor-initata contineat SQL iniectio impetus enuntiatorum in C# WinForms, variis modis uti potes ad detegendam iniectionem et SQL prohibendam. Hic paucae rationes communes sunt;

1. usus parameterized queries

Quaestiones parametrisatae sunt optima praxi ad impediendam iniectio SQL utentis initus ut parametri ad interrogationem SQL transeundo, potius quam illam directe in chorda SQL embedendam. Hoc efficit ut user initus non interpretatur SQL code.

using System.Data.SqlClient;
 
public void ExecuteQuery(string userInput)
{
    string connectionString = "数据库连接字符串";
    string query = "SELECT * FROM Users WHERE Username = @Username";
 
    using (SqlConnection connection = new SqlConnection(connectionString))
    using (SqlCommand command = new SqlCommand(query, connection))
    {
        command.Parameters.AddWithValue("@Username", userInput);
 
        connection.Open();
        SqlDataReader reader = command.ExecuteReader();
        while (reader.Read())
        {
            // Process the data
        }
    }
}

2. Reprehendo user initus pro periculo characters

Commune SQL iniectio indolem et keywords ut singula quotes (') Duplex quotes"), semicolon (;) , symbolum commentarium--) Itemque commune SQL keywords ut * SELECT、INSERT、DELETE、UPDATE、DROP etc).

public bool IsSqlInjection(string input)
{
    string[] sqlCheckList = { "SELECT", "INSERT", "UPDATE", "DELETE", "DROP", "--", ";", "'" };
    foreach (string item in sqlCheckList)
    {
        if (input.IndexOf(item, StringComparison.OrdinalIgnoreCase) >= 0)
        {
            return true;
        }
    }
    return false;
}
 
 
string userInput = txtUserInput.Text;
if (IsSqlInjection(userInput))
{
    MessageBox.Show("输入包含不安全的字符，请重新输入。");
}
else
{
    // 继续处理用户输入
    ExecuteQuery(userInput);
}

3. usus ORM compage

Utens ORM (Objectum relationis Mapping) compages ut Entity Framework periculum valde minuere potest injectionis SQL quia compages ORM ipso facto quaestionibus parametris tractat.

using (var context = new YourDbContext())
{
    var user = context.Users.SingleOrDefault(u => u.Username == userInput);
    if (user != null)
    {
        // Process the user data
    }
}