Php-based independent sql injection defense analysis alarm method and system thereof

Abstract

The invention discloses a php-based independent sql injection defense analysis alarm method and a system thereof, and the method comprises the steps: checking whether a request IP is a forbidden IP blacklist, ending the request if the request IP is the forbidden IP blacklist, and entering the next step if the request IP is not the forbidden IP blacklist; judging whether parameters of sql injectioncontain blacklist symbols, and if yes, setting the sql injection as a note level; judging whether parameters of sql injection contain blacklist keywords, and if yes, setting the sql injection as a winning level; dividing the parameters of the sql injection by taking a space as a criterion, judging whether the parameters contain blacklist keywords, and if yes, setting the sql injection as an errorlevel; and performing sql injection on the error level, checking whether the request ip injected by the sql is subjected to injection attacks for a specified number of times, and if yes, forbidding the request ip and listing the request ip into a forbidden IP blacklist. According to the method, measures are taken for the sql injection problem in an omnibearing manner, corresponding measures are taken for prevention, response, monitoring and recording, and the data security is protected to a greater extent.

Description

technical field [0001] The invention relates to the technical field of SQL injection attacks, in particular to a PHP-based independent SQL injection defense analysis alarm method and a system thereof. Background technique [0002] With the rapid development of Internet technology, Web technology and database technology have become the key technologies of modern information system. Information security based on Web server and database is one of the core Internet security issues. For web servers and databases, they are extremely vulnerable to hackers. Among them, SQL injection attack is a common type of attack faced by web servers at present. The attacker inserts a series of SQL commands by modifying the input field of the web form of the application program or the query string in the page request to change the database query statement. Thereby deceiving the database server to execute malicious SQL commands, thereby realizing unauthorized access to the background database and...

AI Technical Summary

Problems solved by technology

SQL injection attack is the most commonly used attack method when hackers attack web servers, which poses a serious threat to Internet security

[0003] In the prior art, most of the SQL injection attack defense methods are rule-based, that is, the judgment rules for distinguishing normal SQL statements and SQL injection attacks are established in advance. Due to the continuous development and evolution of attack methods, coupled with the amount of data on the Internet Too large and too diverse, it is difficult to establish a complete rule base that can accurately distinguish between normal SQL statements and SQL injection attacks, so this type of method often has a high false positive rate and false negative rate, and needs to be constantly Update the rule base but still can not play a very effective protection

Images