黑马程序员——SQL注入漏洞攻击

SQL注入攻击是黑客对数据库进行攻击的常用手段之一。通过字符串拼接的方式，将程序中的字符串变量username,password与select结合起来，如果有返回值则说明登陆成功，否则登陆失败。因为它的验证方式是通过字符串拼接来完成的，因此我们可以在密码框内这样写：1' or '1' = '1  。显示登录成功。下面是代码部分。

namespace _01第一个mdf

{

    class Program

    {

        static void Main(string[]args)

        {

            stringdataDir = AppDomain.CurrentDomain.BaseDirectory;

            if(dataDir.EndsWith(@"\bin\Debug\")|| dataDir.EndsWith(@"\bin\Release\"))

            {

                dataDir = System.IO.Directory.GetParent(dataDir).Parent.Parent.FullName;

                AppDomain.CurrentDomain.SetData("DataDirectory", dataDir);

            }

Console.WriteLine("请输入用户名?");

 stringusername = Console.ReadLine();

Console.WriteLine("请输入密码?");

string password = Console.ReadLine();//输入 1' or '1' = '1造¨成¨SQL注入¨漏洞攻击

 

            using(SqlConnection sqlcon =new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDBFilename=

                   |DataDirectory|\Database1.mdf;integrated Security=True;UserInstance=True"))

            {

                sqlcon.Open();

                using(SqlCommand cmd = sqlcon.CreateCommand())

                {

                    //cmd.CommandText= "select count(*) from T_Users where UserName='"+ username+"'and Password='"+password+"'";造成注入漏洞攻击

//如下这样¨´，利用参数化查询，将参数放入SQL语句，不会进行字符串的拼接，SQL注入便不攻自破

 

                    cmd.CommandText = "select count(*) from T_Users whereUserName=@UserName and Password=@Password";

                    cmd.Parameters.Add(newSqlParameter("UserName", username));

                    cmd.Parameters.Add(newSqlParameter("Password", password));

                    inti =Convert.ToInt32(cmd.ExecuteScalar());

                    if(i > 0)

                    {

                        Console.WriteLine("登录成功");

                    }

                    else

                    {

                        Console.WriteLine("用户名或密码错误");

                    }

                }

            }

            Console.WriteLine("ok");

            Console.ReadKey();

        }

    }

}