Prevent SQL Injection

We need to pay attention to the following points:

1. Never trust user input. Validate the user's input through regular expressions, or limit the length; convert single quotes and double "-", etc.

2. Never use dynamic assembly sql, you can use parameterized sql or directly use stored procedures for data query and access.

3. Never use database connections with administrator privileges, use separate database connections with limited privileges for each application.

4. Do not store confidential information directly, encrypt or hash out passwords and sensitive information.

5. The abnormal information of the application should give as few hints as possible. It is best to use custom error information to wrap the original error information.


6. The detection method of sql injection generally adopts auxiliary software or website platform to detect, and the software generally adopts sql Injecting the detection tool jsky, the website platform has the Yisi website security platform detection tool. MDCSOFT SCAN et al. Using MDCSOFT-IPS can effectively defend against SQL injection, XSS attacks, etc.