SQL 注入和 .NET 4
Is there instruments in .NET 4 to "automatize" verifications of SQL fields against SQL injections?
I saw this article, but afraid could be not to date...
EDIT:
Oracle Db compatible...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
ADO.NET 中最简单的工具是对所有可变的查询值使用sql 参数。这也具有效率优势。即使您的代码中有显式 sql 并且根本不使用存储过程或函数，您仍然可以通过使用相同的查询字符串而仅改变参数值来获得这两个优点。
有时（例如使用搜索引擎）您可能确实需要动态构建 sql 命令文本，而无法使用 sql 参数。这是不幸的，因为保护自己免受 SQL 注入的其他方法（各种清理和关键字黑名单）更加复杂，并且需要您深思熟虑和聪明。尽量避免这种情况！
The simplest instrument in ADO.NET is to use sql parameters for all your query values that are variable. This also has an efficiency advantage. Even if you have explicit sql in your code and are not using stored procedures or functions at all, you still gain both of these advantages by using the same query string while varying only the values of your parameters.
There may be times (with search engines for example) when you really need to construct your sql command text dynamically, without being able to use sql parameters . This is unfortunate, because the other ways of protecting yourself against sql injection (various kinds of sanitizing and keyword blacklists) are more involved and require you to be thoughtful and clever. Try to avoid this!
我相信您可以通过使用 sqlparameters 来避免该问题。
I believe you avoid the problem by using sqlparameters.
这是一个“ADO.NET”问题吗？如果是的话，那么 SQLParameters 就是你的朋友。 Scott Gu 关于这个主题的文章很旧，但仍然非常有用，并且提供了很好的建议。
http://weblogs .asp.net/scottgu/archive/2006/09/30/Tip_2F00_Trick_3A00_-Guard-Against-SQL-Injection-Attacks.aspx
如果您不使用 ADO.NET，那么大多数 ORM 会为您提供防御攻击的保护。例如，LLBLGen 生成参数化查询。 Linq to SQL 也是如此。我猜他们都这样做，不过请检查一下您对 ORM 的风格:)
Is this an "ADO.NET" question? If it is then yeah SQLParameters are your friend. Scott Gu's article on the subject is old but still quite useful and has good advice.
http://weblogs.asp.net/scottgu/archive/2006/09/30/Tip_2F00_Trick_3A00_-Guard-Against-SQL-Injection-Attacks.aspx
If you're not using ADO.NET then most ORMs will protect against attacks for you. LLBLGen for example generates parametized queries. As does Linq to SQL. I'm guessing that they all do, although check with your flavour of ORM :)
对我来说，最简单的手段就是使用Linq2Sql来查询数据库。文章中没有提及，因为它不存在。您也可以使用实体框架。它提供了更多的功能和更高的学习曲线。还有很多其他 ORM，大多数（也许全部，但我不知道）都会保护您免受 SQL 注入。另一个好处是 ORM 负责根据结果创建对象。
For me, the simplest means is to use Linq2Sql to query the database. It wasn't mentioned in the article because it didn't exist. You could also use Entity Framework as well. It offers more power with a bit higher learning curve. There are plenty of other ORMs and most (perhaps all but I don't know) will protect you against SQL injection. The other nice thing is that the ORM takes care of creating an object from the result.