SQL injection prevention method, device and system

Abstract

The invention relates to the technical field of computers and discloses an SQL injection prevention method, device and system. The method includes the steps that before a structured query language (SQL) statement is sent to a database server, semantic information is embedded into the SQL statement, and submitted data containing the SQL statement and the semantic information are generated, wherein the semantic information contains an SQL template corresponding to the SQL statement, a start symbol and an end symbol, and the start symbol and the end symbol are used for marking the position of the SQL template; the submitted data are sent to the database server. Through the method, it is effectively avoided that sensitive data in the server are obtained by an attacker through SQL injection and then are used for attacking application programs, and thus error reports and failure reports are avoided.

Description

technical field [0001] The invention relates to the field of computer technology, in particular to a method, device and system for defending against SQL injection. Background technique [0002] With the development of B / S (browser / server) mode application development, more and more programmers use this mode to write application programs. The legitimacy of the data input by the user is detected, which makes the application program have certain security risks, and causes the application program to have the risk of Structured Query Language (SQL, Structured Query Language) injection. [0003] SQL is a database query and programming language for accessing data and querying, updating, and managing relational database systems; while SQL injection inserts SQL commands into Web forms, or enters SQL commands into domain names, or inserts SQL commands Inserted into the query string of the page request, and finally trick the server to execute malicious SQL commands. Attackers attack ...

AI Technical Summary

Problems solved by technology

[0010] However, the above method 1) can be used in many forms of SQL injection attacks, it is difficult to describe all possible attack forms with a set of attack characteristic rules, and will not hit normal SQL statements, so there are high false positives, The problem of high underreporting

The above method 2) has the problem of over-learning and under-learning. Over-learning usually means that the attack traffic is mixed into the normal traffic and learned by mistake, which leads to the characteristics of the attack being brought into the final normal traffic model. At this time, when detecting It will lead to the problem of false negatives; under-learning usually means that the learning traffic does not contain all normal traffic patterns, resulting in the model of some normal traffic not being learned, which will lead to false positives during the detection process

The above method 3) cannot handle injection in HTTPS requests; cannot handle applications that encode parameters (need to be modified and implemented for specific applications), so the application scenarios of this method are limited; in addition, this method is still suitable for complex SQL injection attacks. There are some false positives and false negatives

It can be seen that there are problems of false positives and false negatives in related technologies.

Images