Structured query language (SQL) injection attacking protection method based on internal storage

Abstract

The invention discloses a structural query language (SQL) injection attacking protection method based on internal storage. The SQL injection attacking protection method based on the internal storage comprises following steps including user registration, user modification and user authentication. The user registration includes that user information is put in a data bank and put in an internal storage data bank. The user modification includes that the user information of the data bank is modified, and synchronously, the user information of the internal storage data bank is modified. The user authentication includes that according to a state of a configuration item, an internal storage data bank mode or a data bank mode is selected to verify the user information. On one hand, through a No SQL internal storage data bank, key-value-to-information which is stored in advance is used as verification information to be compared with a verification condition which is submitted by a user, therefore, a traditional SQL statement comparing method is radically replaced, and occuring of SQL injection is avoided. On the other hand, a whole verification process is based on calculating of internal storage data, and is not interacted with hard disc storage medium of a server, and therefore, operation efficiency is greatly improved..

Description

technical field [0001] The invention relates to a SQL injection attack protection method, in particular to a memory-based SQL injection attack protection method, and belongs to the technical field of network security. Background technique [0002] With the development of Internet, Web application systems based on B / S mode, such as e-commerce systems and e-government systems, are more and more favored by users. Most web application systems need to interact with users. When the user applies for interaction with the server, the server verifies, controls and records the user's behavior through the login interface, which plays a role in protecting the operation security. [0003] In the traditional database verification mode, after the user enters the user name and password on the login interface, the data validity verification is first performed on the client side. If the data is illegal (such as entering characters that are not allowed) or the content is empty, If the user is...

AI Technical Summary

Problems solved by technology

However, the traditional database verification mode has the following problems: the client or server side verification is not strict, and it is impossible to prevent users from entering some illegal information, the most dangerous of which is SQL injection

Since SQL injection is accessed from the normal WWW port, and it looks no different from normal web page access, so currently commonly used firewalls cannot detect SQL injection

Images