SQL (structured query language) injection attack protection method based on database

Abstract

The invention provides an SQL (structured query language) injection attack protection method based on a database. A bottom layer driving data safe case is built on an operation system layer, a virtual space is formed by a hard disc cache, the database is loaded in the virtual space, when the external data visits the database, the data firstly passes through the data safe case, and the data safe case is in charge of the data exchange between the external data and the data inside the data safe case; and the management end of the data safe case records coming addresses of the external data, a port of the data safe case turns to a driver for forming a filtering passage for reaching the database, a filtering driver of the data safe case filters all external data visiting the database, safe codes are permitted to enter the database, and malicious codes are filtered and cleared. The SOL injection risk can be fundamentally avoided through the SQL injection attack protection method.

Description

technical field [0001] The invention relates to the field of network security, in particular to a database-based SQL injection attack protection method. Background technique [0002] Web security is complex, and SQL injection is the most harmful. SQL Injection, the Chinese name is "SQL injection" is a means of database attack, and it is also a manifestation of the existence of WEB application vulnerabilities. Its actual meaning is to use the external interface of certain databases to insert user data into the actual database operation. Language, so as to achieve the purpose of invading the database and even the operating system. [0003] The main form of SQL Injection is to directly insert code into user input variables that are concatenated and executed with SQL commands, and indirectly inject malicious code into strings to be stored in tables or as metadata, and the stored strings are subsequently string When connected to a dynamic SQL command, execute the malicious code...

AI Technical Summary

Problems solved by technology

[0009] 3. Great danger

[0010] 4. Very serious tangible and intangible losses

[0011] For the above-mentioned risks of SQL injection, most of the current solutions in the industry are to optimize the code quality or improve the protection level, and cannot fundamentally solve the problem of SQL injection.

The Chinese patent application with application number 200710099534.4 discloses a method and system for detecting SQL injection vulnerabilities. This method and system are program-based, and its main function is to intercept and integrate HTTP packets before external data enters the SQL database. This interception and integration impacts external access

Images