- Never trust user input(不要信任用户输入) Validate all textbox entries using validation controls, regular expressions, code, and so on (用验证控件验证所有的输入框,正则表达式,编码等)
- Never use dynamic SQL(不要使用动态sql) Use parameterized SQL or stored procedures(应该用参数化sql或存储过程)
- Never connect to a database using an admin-level account(不要用管理级账号连接数据库) Use a limited access account to connect to the database (用限制级账号连接数据库)
- Don't store secrets in plain text (不要保存秘密信息在纯文本中)Encrypt or hash passwords and other sensitive data; you should also encrypt connection strings (应该加密或搞乱密码和其它敏感数据,也应该加密连接字符串)
- Exceptions should divulge minimal information(异常应该泄漏最少信息) Don't reveal too much information in error messages; use customErrors to display minimal information in the event of unhandled error; set debug to false(不要在出错消息中暴露太多信息,如果发生未错误处理应该用自定义错误信息显示最少信息,设置调试为false)
Preventing SQL Injection Attacks 预防SQL注入式攻击
最新推荐文章于 2024-08-19 20:48:55 发布