我如何知道我的网站是否容易受到 SQL 注入攻击？
我知道很多人都问过这个问题，但不幸的是我找不到我的问题的正确答案。
在我读过的所有有关 SQL 注入的文章中，他们都讨论了这样的 URL： http://www.example.com/member.php?id=1 以及如何使用 (') 检查我的网站是否容易受到 SQL 注入攻击。
就我而言，我的网站是这样的： http://www.example.com/Login.php 如您所见，我没有 ?id=1，我应该如何测试我的网站？
谢谢
I know that this question has been asked by many people but unfortunately I couldn't find the proper answer for my question.
In all the articles that I have read about SQL Injection, they talk about the URLs such that
http://www.example.com/member.php?id=1
and how I can check if my website is vulnerable to SQL Injection using (').
In my case, my website is such that:
http://www.example.com/Login.php
As you can see I don't have ?id=1, What should I do to test my website?
Thank you
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
通过使用查询的硬编码变量部分，您很容易受到 SQL 注入的攻击。换句话说，使用命名参数可以防止这种情况发生。
如果您只是盲目地将字符串注入到您的查询中，而没有参数或卫生条件，那么您基本上是在允许公众（即潜在的坏人）直接访问您的数据库编写 SQL 代码。
SQL注入是一个很难用SO答案来形容的主题，所以我强烈推荐关于 SQL 注入的维基百科文章。
You are vulnerable to SQL Injection through the use of hardcoded variable portions of your query. In other words, using named parameters prevents this.
If you just blindly take strings and inject them into your queries without parameters or sanitation, you are basically allowing public people (i.e. potentially bad people) direct access to write SQL code against your database.
SQL Injection is a topic that is hard to fit in an SO answer, so I highly recommend the Wikipedia article on SQL Injection.
SQL 注入是将 SQL 查询直接注入网站预配置代码的能力。这可以通过像“;”这样简单的东西来完成添加符号以附加您的代码，但绝不限于此。
要检查您的网站是否存在 XSS，最好的办法是在针对数据库运行之前验证从网页获取的所有输入是否都经过验证。例如，这意味着在您的应用程序代码中，您正在验证网站上的发布按钮仅包含您期望的参数，仅包含您期望的参数。现场验证和限制是您试图限制的主要漏洞。
请勿将您的网页用作验证工具。想要利用 XSS 的黑客不一定会使用您的页面来执行此操作。这意味着您的业务逻辑是需要评估的。
SQL injection is the ability to inject SQL queries directly into your websites preconfigured code. This can be done with something as simple as a ';' symbol added to append your code, but is in no way limited to this.
To check your site for XSS the best thing to do is verify that all of the inputs taken from the webpage are verified prior to running against your database. For instance, this means that within your application's code you are verifying that the post button on your website only contains parameters that you are expecting and nothing more. Field verification and limits are the main vulnerabilities that you are trying to limit.
Do not use your webpage as a verification tool. Hackers looking to exploit XSS will not necessarily be using your page to do this. This means your business logic is what needs to be assessed.
如果您接受用户输入并使用 SQL，则很容易受到 SQL 注入的攻击。您是否已充分保护自己免受 SQL 注入是另一个问题。
You are vulnerable to SQL Injection if you accept user input and you use SQL. Whether or not you have sufficiently protected yourself against SQL injection is another question.