http://xxx.com/a.jsp?id=1
HttpServletRequest request,HttpServletResponse ressponse){
JdbcConnection conn = new JdbcConnection();
final String sql = "select * from product where pname like '%"
+ resuest.getParameter("id") + "%'"
conn.execqueryResultSet(sql);
}
上述代码中，百分号没有闭合，导致了注入漏洞的存在
此时的查询语句为：
final String sql = "select * from product where panme l ike '%1' or '%'='%'"
不同状态下可能存在注入的情况：
# 1. 伪静态
http://1223.com/122.html
String id = url.Substring(url.length-9,4);
final String sql = "select *from product where di = " + id
conn.execqueryResultSet(sql);
# 2. 登录框
POST /login.action
username=admin&password=admin
String sql = "select * from usertable where name ='" +username+"' and password = '" + password + "'"
# 3. header头参数引起的注入
username,cookie,X-Forward-For等
String referer = request.getHeader("referer");
String sql = "update TABLE set referer = '" + referer + "'";
注入之JDBC
JDBC： 连接数据库最常用的方法
# 1. 直接从request中获取参数然后拼接
String sql = "select * from product where pname like '%" + request.getParameter("name") + "%'";
# 2. 参数由方法传递而来
String sql = "select * from product where pname like '%" + name + "%'";
注入之Mybatis
<select>
select * from table where name like '%$value$%'
<select>
select * from news where id in (${id})
select * from news where title = '新年' order by ${time} asc;
PreparedStatement stmt = null
ResultSet rs = null
try
{
String userName = ctx.getAuthenticatedUserName(); //this is a constant
String itemName = request.getParameter("itemName");
// ...Ensure that the length of userName and itemName is legitimate
// ...
String sqlString = "SELECT * FROM t_item WHERE owner=? AND itemName=?";
stmt = connection.prepareStatement(sqlString);
stmt.setString(1, userName);
stmt.setString(2, itemName);
rs = stmt.executeQuery();
// ... result set handling
}
catch (SQLException se)
{
// ... logging and error handling
}
如果使用参数化查询，则在SQL语句中使用占位符表示需在运行时确定的参数值。参数化查询使得SQL查询的语义逻辑被预先定义，而实际的查询参数值则等到程序运行时再确定。参数化查询使得数据库能够区分SQL语句中语义逻辑和数据参数，以确保用户输入无法改变预期的SQL查询语义逻辑。在Java中，可以使用java.sql.PreparedStatement来对数据库发起参数化查询。在这个正确示例中，如果一个攻击者将itemName输入为name' OR 'a' = 'a，这个参数化查询将免受攻击，而是会查找一个itemName匹配name' OR 'a' = 'a这个字符串的条目。
错误示例（在存储过程中动态构建SQL）:
Java代码：
CallableStatement = null
ResultSet results = null;
try
{
String userName = ctx.getAuthenticatedUserName(); //this is a constant
String itemName = request.getParameter("itemName");
cs = connection.prepareCall("{call sp_queryItem(?,?)}");
cs.setString(1, userName);
cs.setString(2, itemName);
results = cs.executeQuery();
// ... result set handling
}
catch (SQLException se)
{
// ... logging and error handling
}
SQL Server存储过程：
CREATE PROCEDURE sp_queryItem
@userName varchar(50),
@itemName varchar(50)
AS
BEGIN
DECLARE @sql nvarchar(500);
SET @sql = 'SELECT * FROM t_item
WHERE owner = ''' + @userName + '''
AND itemName = ''' + @itemName + '''';
EXEC(@sql);
END
GO
CallableStatement = null
ResultSet results = null;
try
{
String userName = ctx.getAuthenticatedUserName(); //this is a constant
String itemName = request.getParameter("itemName");
// ... Ensure that the length of userName and itemName is legitimate
// ...
cs = connection.prepareCall("{call sp_queryItem(?,?)}");
cs.setString(1, userName);
cs.setString(2, itemName);
results = cs.executeQuery();
// ... result set handling
}
catch (SQLException se)
{
// ... logging and error handling
}
SQL Server存储过程：
CREATE PROCEDURE sp_queryItem
@userName varchar(50),
@itemName varchar(50)
AS
BEGIN
SELECT * FROM t_item
WHERE userName = @userName
AND itemName = @itemName;
END
GO