键或哈希可以触发注射攻击吗？
可以（故意或意外地）产生的哈希或键会引发注射攻击吗？例如，如果将哈希或密钥作为select％0D*％0dfrom％0DWhere产生，这是否会引起注射攻击？我知道当前的技术和标准，任何体面的保护都会防止包括所有投入，哈希和钥匙，因此几乎肯定不会影响现实中的任何系统。
是的，我被告知这是此类问题的错误位置。是的，我现在知道下次将其放在哪里。
Can hashes or keys generated (either intentionally or accidentally) that would trigger an injection attack? For example, if the hash or key was generated as something like SELECT%0d*%0dFROM%0dWHEREVER, could this cause an injection attack? I am aware with current technologies and standards, any decent protection will protect against all input, hashes and keys included, so it almost surely wouldn't effect any systems in reality.
Yes, I have been informed this is the wrong location for this type of question. Yes, I am now aware of where to put it next time.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从理论上讲，我认为哈希函数的结果可能会导致特定的字节顺序恰好是SQL语法，当用作原始二进制字节时，或者如果在可打印的ASCII字符范围内编码（通过值0x20，则通过0x7f）。
但是，提出一个输入字符串是一项很难的任务，该输入字符串在哈希时产生了确切的结果。
哈希功能的结果始终是固定的，具体取决于哈希算法和选项。因此，您需要牢记适合该固定长度的攻击查询，然后您需要找到精确到该字符串的输入。
另外，防御这种攻击的方法与针对任何其他SQL注入攻击的防御相同：使用查询参数。任何不安全的内容，无论是否是哈希功能的结果，如果将SQL注入与SQL语法分开，则能够实现它。
我认为还有其他攻击方式将更容易，更有效。社会黑客攻击仍然是最通用的攻击手段，几乎可以解决任何安全辩护。
In theory, I suppose it's possible that the result of a hash function would result in a specific sequence of bytes that happens to be SQL syntax, either when used as raw binary bytes or if encoded in the range of printable ASCII characters (values 0x20 through 0x7F).
But it would be a hard task to come up with an input string that produced that exact result when hashed.
The result of a hash function is always of fixed length, depending on the hash algorithm and options. So you would need to have an attack query in mind that fit in that fixed length exactly, and then you would need to find the input that hashed to that string exactly.
Also, the method for defending against such an attack is the same as defending against any other SQL injection attack: use query parameters. Any unsafe content, no matter if it is the result of a hash function or not, is able to effect an SQL injection if it is kept separate from the SQL syntax.
I think there are other means of attack that would be easier and more effective. Social hacking is still the most general-purpose means of attack, and can get around just about any security defense.