正则表达式防止 sql/脚本注入
我正在尝试为客户端验证创建一个正则表达式（在服务器端验证之前），以防止sql/脚本注入，即类似这样的东西 - 这不会 work
(script)|(<)|(>)|(%3c)|(%3e)|(SELECT) |(UPDATE) |(INSERT) |(DELETE)|(GRANT) |(REVOKE)|(UNION)|(&lt;)|(&gt;)
这个（上面）表达式的正确格式是什么，以便我可以让它工作？
例如，我的电子邮件检查器是这样的
(/^[^\\W][a-zA-Z0-9\\_\\-\\.]+([a-zA-Z0-9\\_\\-\\.]+)*\\@[a-zA-Z0-9_]+(\\.[a-zA-Z0-9_]+)*\\.[a-zA-Z]{2,4}$/))
哦，如果您能想到其他任何要添加的内容，请“喊”。
I am trying to create a regex expression for client side validation (before server side validation which will also take place) to prevent sql/script injection i.e something like this - which does not work
(script)|(<)|(>)|(%3c)|(%3e)|(SELECT) |(UPDATE) |(INSERT) |(DELETE)|(GRANT) |(REVOKE)|(UNION)|(<)|(>)
What is the correct format for this (above) expression so I can get it to work?
e.g. my EMail checker is like this
(/^[^\\W][a-zA-Z0-9\\_\\-\\.]+([a-zA-Z0-9\\_\\-\\.]+)*\\@[a-zA-Z0-9_]+(\\.[a-zA-Z0-9_]+)*\\.[a-zA-Z]{2,4}$/))
Oh and if you can think of anything else to add please "shout".
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
通常，Sql 注入发生在传递给 sql 命令（例如 insert、update、delete 或 select）参数的字符串中。此正则表达式验证 sql 命令中是否有任何内联注释或块注释。
Generally Sql Injection occurs in the strings passed to the parameters of a sql command such as insert, update, delete, or select. This regular expression validates whether there is any inline or block comment in the sql command.
您不能以任何方式阻止客户端的 SQL 注入尝试。这是一个非常非常糟糕的想法，它不能帮助你，但可能会给真正的用户带来麻烦。它不会阻止任何有机会实际利用 SQLi 的人。
就正则表达式而言，您需要在开头和结尾添加 / ，就像在邮件示例中一样，以表示它是正则表达式。另外，我认为正则表达式设计是有缺陷的，因为它仍然允许许多注入向量。例如，它允许可怕的单引号 ', -- 注释等。它甚至没有开始涵盖 RDBMS 中可能出现的所有内置功能。攻击者经常会利用服务器端已有的 SELECT 语句，因此删除它们可能也无济于事。
最好的防御是在服务器端使用参数化查询（例如 php 和 postgres 的 pg_prepare）
You cannot in any way even hinder SQL injection attempts on the client side. It is a terrible, terrible idea which cannot help you but may cause a ball-ache for genuine users. It will not stop anyone who has a chance of actually exploiting an SQLi.
As far as the regex goes, you need to add the / at the beginning and end, like in your mail example, to denote it is a regex. Also, I think the regex design is flawed as it still allows many injection vectors. For example it allows the dreaded single quote ', -- comments and other. It doesn't even start to cover all the builtin functions of your RDBMS that might be knocking around. An attacker will often make use of, e.g. SELECT statements already on your server side, so removing them probably wouldn't help either.
Your best defense is to use parametrized queries on the server side (e.g. pg_prepare for php & postgres)
仅 az 或 AZ 或 0-9 4-8 个字符：
Only a-z or A-Z or 0-9 between 4-8 characters:
SQL 注入和转义对很多人来说听起来很神奇，就像抵御某些神秘危险的盾牌，但是：不要害怕它 - 这没什么神奇的。这只是让查询能够处理特殊字符的方法。
所以，不要发明新的魔法护盾以及如何保护魔法注入危险的方法！ 相反，尝试了解如何转义输入作品。
SQL injection and escaping sound magical to many people, something like shield against some mysterious danger, but: don't be scared of it - it is nothing magical. It is just the way to enable special characters being processed by the query.
So, don't invent new magial shields and ways how to protect the magical injection danger! Instead, try to understand how escaping of the input works.
更常见的是转义“and”等控制字符，这样人们仍然可以将 SQL 代码输入数据库，假设它在 CMS 上，我将添加一篇有关 SQL 注入的文章。我想使用这些单词和字符而不触发注入。看看它，它似乎是基于 HTML 的东西，所以将 <<和>到<和 >，这将清理所有 html 标签，同时仍然允许显示 HTML 演示内容。
正如已经说过的，这应该全部是服务器端的，因为它进入系统。
It's more common to escape the control characters like `and ' that way one can still enter SQL code into the database, say it is on a CMS and I'm adding an article about SQL injection. I want to use those words and characters without triggering an injection. Looking at it, it seems to be for something with HTML base so convert the < and > to < and >, that will sanitize any and all html tags while still allowing HTML demo content to be displayed.
As already said, this should all be server side, as it comes into the system.