黑马程序员——SQL注入漏洞攻击

---------------------- Windows Phone 7手机开发、.Net培训、期待与您交流！ ----------------------


表
MyTable
username password
admin 888888
test 123456


登录案例一：SQL语句字符串拼接代码如下：

string strcon = "Data Source=.;Initial Catalog=LearnDataBase;Integrated Security=True";
Console.WriteLine("请输入用户名：");
string username = Console.ReadLine();
Console.WriteLine("请输入密码：");
string password = Console.ReadLine();
using (SqlConnection conn = new SqlConnection(strcon))
{
conn.Open();
using (SqlCommand cmd = conn.CreateCommand())
{
string sqlconn = "select COUNT(*) from MyUsers where username='" + username + "' and
password='" + password + "'";
cmd.CommandText = sqlconn;
int i= Convert.ToInt32(cmd.ExecuteScalar().ToString());
if (i == 1)
{
Console.WriteLine("登陆成功！");
}
else
{
Console.WriteLine("用户名密码错误！");
}
}
}
Console.ReadKey();
当密码输入1' or '1'='1时注入漏洞攻击
代码修改使用参数化查询

using (SqlConnection conn = new SqlConnection(strcon))
{
conn.Open();
using (SqlCommand cmd = conn.CreateCommand())
{
string sqlconn = "select count(*) from MyUsers where username=@username and password=@password";
cmd.CommandText = sqlconn;
cmd.Parameters.Add(new SqlParameter("username", username));
cmd.Parameters.Add(new SqlParameter("password", password));
int i = Convert.ToInt32(cmd.ExecuteScalar().ToString());
if (i > 0)
{
Console.WriteLine("登陆成功！");
}
else
{
Console.WriteLine("用户名密码错误！");
}
}
}
Console.ReadKey();
再次输入username=admin password=1' or '1'='1的时候登录不成功


---------------------- Windows Phone 7手机开发、.Net培训、期待与您交流！ ----------------------