System and method for SQL injection prevention

Abstract

The invention discloses a system and method for preventing SQL injection, which includes an IP blacklist filter module, a request rule detection module and an http response interception module; the IP blacklist filter module is used to set the request source IP meeting certain attack conditions as Blacklist, the system automatically intercepts IP requests in the blacklist; the request rule detection module is used to detect the legality of request parameters for requests that pass IP detection, and intercept requests with abnormal parameters; the http response interception module is used to Intercept error return information, filter out error prompt information, and prevent sensitive information from being exposed. The invention solves the security problem of the existing SQL injection or SQL hidden danger system, and increases the security of the server.

Description

Technical field [0001] The invention relates to the technical field of server data anti-injection, in particular to a SQL anti-injection system and method. Background technique [0002] The web application is based on the http protocol. The client sends an http request with parameters, the server parses the request, and submits it to the application processing program, and then the application processing program constructs the corresponding SQL query statement to query the data in the database. Based on this way of working, the server is vulnerable to SQL attacks. SQL injection is one of the commonly used service attack methods. Many service websites have SQL injection vulnerabilities. Attackers often use SQL injection to attack. After success, they can add, delete, modify, and erase data in the data at will. harm. There are mainly three common methods to prevent SQL injection: 1) Constraints in the development process, which are developed in accordance with the code developmen...

AI Technical Summary

Problems solved by technology

There are three common ways to prevent SQL injection: 1) Constraints in the development process, developed in full compliance with code development standards; 2) Filtering based on keywords and rules; 3) Configuring parameters for receiving web pages, Configure the whitelist of submission parameters; the common method of preventing SQL injection also has certain defects, based on keyword and rule filtering, poor defense against tentative SQL attacks and special SQL attacks, prone to false positives and false negatives ;To submit the configuration parameters to the whitelist, it is necessary to configure all the parameters that can be received by the web page, which is a lot of work, expensive, and prone to errors

Images