Data processing method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a data processing method and device, equipment and a storage medium. The method comprises the steps of obtaining a first SQL statement of a database, wherein the first SQL statement comprises an input parameter; and replacing the input parameter in the first SQL statement with a placeholder, and generating a second SQL statement corresponding to the first SQL statement. And obtaining a data type corresponding to the placeholder according to the semantics of the second SQL statement. If the data type of the input parameter is not matched with the data type corresponding to the placeholder, first prompt information is output, and the first prompt information is used for prompting that the risk exists in the first SQL statement. According to the method, the SQL injection risk can be reduced, and the performance overhead for recognizing the SQL injection risk can be reduced.

Description

Technical Field

[0001] This application relates to the field of database technologies, and in particular, to a data processing method, apparatus, device, and storage medium. Background Art

[0002] In recent years, with the development of new database application scenarios such as mobile Internet, big data, and artificial intelligence, as well as new database hardware technologies, the importance of databases has been increasing day by day. Among them, the data security issue of databases is of utmost importance in the database field.

[0003] Currently, Structured Query Language (SQL) injection is a common and harmful network attack technology, mainly targeting application programs with database interactions. Attackers take advantage of the vulnerability that application programs do not fully verify and filter the data input by users, and insert or tamper with SQL statements by constructing malicious input data, thereby obtaining unauthorized access to the database and endangering the data security of the database. However, the current methods for preventing SQL injection have problems such as poor effectiveness and high performance overhead of application programs.

[0004] Therefore, how to reduce the risk of SQL injection and reduce the performance overhead of application programs is an urgent problem to be solved. Summary of the Invention

[0005] Embodiments of this application provide a data processing method, apparatus, device, and storage medium to achieve the effect of reducing the risk of SQL injection and reducing the performance overhead of application programs.

[0006] In a first aspect, an embodiment of this application provides a data processing method, including:

[0007] Obtain a first SQL statement of a database, where the first SQL statement includes input parameters;

[0008] Replace the input parameters in the first SQL statement with placeholder characters to generate a second SQL statement corresponding to the first SQL statement;

[0009] Obtain the data type corresponding to the placeholder character according to the semantics of the second SQL statement;

[0010] If the data type of the input parameter does not match the data type corresponding to the placeholder character, output a first prompt message, where the first prompt message is used to prompt that the first SQL statement has a risk.

[0011] Optionally, the step of if the data type of the input parameter does not match the data type corresponding to the placeholder character, output a first prompt message includes:

[0012] If the data type of the input parameter is different from the data type corresponding to the placeholder, output the first prompt message.

[0013] Optionally, if the data type of the input parameter does not match the data type corresponding to the placeholder, output the first prompt message, including:

[0014] Perform data type conversion on the input parameter according to the data type corresponding to the placeholder;

[0015] If the data type conversion fails, output the first prompt message.

[0016] Optionally, obtaining the data type corresponding to the placeholder according to the second SQL statement includes:

[0017] Perform semantic analysis on the second SQL statement to determine the identifier corresponding to the placeholder in the second SQL statement;

[0018] Obtain the data type of the identifier;

[0019] According to the data type of the identifier, obtain the data type corresponding to the placeholder.

[0020] Optionally, obtaining the data type of the identifier includes:

[0021] Obtain the data table structure information in the database, where the data table structure information includes the association relationship among the data table, data column, and data type;

[0022] According to the data table structure information and the identifier, obtain the data type of the identifier.

[0023] Optionally, obtaining the data type corresponding to the placeholder according to the data type of the identifier includes:

[0024] According to the identifier, determine the operator corresponding to the identifier;

[0025] Based on the semantics of the operator and the data type of the identifier, obtain the data type corresponding to the placeholder.

[0026] Optionally, it further includes:

[0027] Perform syntax analysis on the second SQL statement;

[0028] If the analysis result of the syntax analysis passes, perform semantic analysis on the second SQL statement;

[0029] If the parsing result of the syntax analysis fails, a second prompt message is output, and the second prompt message is used to indicate that there is a syntax error in the first SQL statement.

[0030] In a second aspect, an embodiment of the present application provides a data processing device, including:

[0031] A first acquisition module, configured to acquire a first SQL statement of a database, where the first SQL statement includes input parameters;

[0032] A processing module, configured to replace the input parameters in the first SQL statement with placeholder symbols to generate a second SQL statement corresponding to the first SQL statement;

[0033] A second acquisition module, configured to acquire a data type corresponding to the placeholder symbol according to the semantics of the second SQL statement;

[0034] A control module, configured to output a first prompt message if the data type of the input parameter does not match the data type corresponding to the placeholder symbol, and the first prompt message is used to prompt that there is a risk in the first SQL statement.

[0035] In a third aspect, an embodiment of the present application provides an electronic device, including: a memory, a processor;

[0036] The memory stores computer execution instructions;

[0037] The processor executes the computer execution instructions stored in the memory, so that the processor executes the implementation manner described in any one of the first aspects above.

[0038] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, where computer execution instructions are stored in the computer-readable storage medium, and when the computer execution instructions are executed by a processor, they are used to implement the implementation manner described in any one of the first aspects above.

[0039] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the implementation manner described in any one of the first aspects above.

[0040] The data processing method, device, equipment, and storage medium provided by the embodiments of the present application generate a second SQL statement corresponding to the first SQL statement by obtaining the first SQL statement of the database and replacing the input parameters in the first SQL statement with placeholder symbols. According to the semantics of the second SQL statement, the data type corresponding to the placeholder symbol is obtained. If the data type of the input parameter does not match the data type corresponding to the placeholder symbol, a first prompt message for prompting that there is a risk in the first SQL statement is output, thereby reducing the performance consumption of the application program and improving the effect of identifying SQL injection risks. Brief Description of the Drawings

[0041] The drawings herein are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present application, and are used together with the specification to explain the principles of the present application.

[0042] Figure 1 It is a schematic diagram of the application scenario of the present application;

[0043] Figure 2 It is a schematic flowchart of a data processing method provided by an embodiment of the present application;

[0044] Figure 3 It is a schematic flowchart of another data processing method provided by an embodiment of the present application;

[0045] Figure 4 It is a schematic flowchart of yet another data processing method provided by an embodiment of the present application;

[0046] Figure 5 It is a schematic flowchart of still another data processing method provided by an embodiment of the present application;

[0047] Figure 6 It is a schematic structural diagram of a data processing device provided by an embodiment of the present application;

[0048] Figure 7 It is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

[0049] Through the above-mentioned drawings, specific embodiments of the present application have been shown, and there will be more detailed descriptions hereinafter. These drawings and text descriptions are not intended to limit the scope of the concept of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. Detailed Embodiments

[0050] Exemplary embodiments will be described in detail herein, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

[0051] The terms "first", "second", "third", "fourth", etc. (if any) in the specification, claims and above-mentioned drawings of the present application are used to distinguish similar objects and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0052] Figure 1 is a schematic diagram of the application scenario of the present application. As Figure 1 shown, the present application is applied in the technical field of databases. Among them, the database 20 can be a device such as an SQL database, an Oracle database, a Kingbase database, etc. that can be used to store data. The embodiments of the present application do not limit the type of the database 20. The electronic device 10 can be a device such as a computer, a server, a workstation, etc. The electronic device 10 can communicate with the database 20.

[0053] In one application scenario, the user can send an SQL statement to the electronic device 10. The SQL statement can include, for example, a data query statement, a data operation statement, a data definition statement, a data control statement, etc.

[0054] The data query statement is used to query data that meets the conditions in the database 20. Then, the electronic device 10 obtains data from the database 20 according to the data query statement and returns it to the user who needs to query the data.

[0055] The data operation statement is used to perform operations such as insertion, update, or deletion on the data in the database 20. After receiving the data operation statement, the electronic device 10 will operate on the corresponding data in the database 20 according to the instructions of the statement, and after the operation is completed, feedback the result information of the operation execution to the user.

[0056] Data definition statements are used to create, modify, or delete the structure of database 20. After receiving a data definition statement, electronic device 10 will adjust the structure of database 20 according to the statement content, such as creating a new table structure, modifying the fields of an existing table, etc. After the operation is completed, electronic device 10 will feedback the execution status of the database structure change operation to the user.

[0057] Data control statements are used to manage the access permissions of database 20. After receiving a data control statement, electronic device 10 will adjust the access permissions of database 20 according to the permission settings specified in the statement. For example, it will grant or revoke certain operation permissions of specific users on database objects. After the permission control operation is completed, electronic device 10 will feedback the result of the permission setting operation to the user.

[0058] Subsequent embodiments mainly introduce the data processing method provided by this application by taking data query statements as an example.

[0059] Currently, attackers can take advantage of the vulnerability that the application does not fully verify and filter the data input by users to construct malicious input data to insert or tamper with SQL statements, thereby obtaining unauthorized access to the database and endangering the data security of the database.

[0060] For example, attackers can bypass the authentication mechanism by constructing SQL injection statements to obtain sensitive information stored in the database, such as user accounts, passwords, card numbers, etc. Or, they can modify important data in the database by injecting malicious statements, such as tampering with transaction records, user permissions, etc., seriously affecting the integrity of the data and the normal operation of the business. Or, in extreme cases, attackers can use SQL injection to delete the entire database or key table structures, resulting in data loss and the paralysis of the business system, causing huge losses.

[0061] Among them, SQL injection can be mainly divided into the following two types: semantic-changing type and multi-statement injection type.

[0062] Exemplarily, taking a data query statement as an example, assume the data query statement is as shown below:

[0063] param1 := 1;

[0064] v_sql := 'select*from t1 where id ='|| param1;

[0065] execute v_sql;

[0066] This data query statement is used to query data in the database where the id is equal to a certain value (in this example, id = 1). Correspondingly, the actual execution statement of this data query statement is equivalent to'select * from t1 where id = 1'.

[0067] An attacker can maliciously tamper with the content of the string param1, thereby changing the semantics of the data query statement to achieve unauthorized access to the database. For example, the content of the string param1 can be tampered with to param1 := '1 or1=1'. At this time, the executed data query statement is as follows:

[0068] param1 := ‘1 or 1=1’;

[0069] v_sql := 'select * from t1 where id = '|| param1;

[0070] execute v_sql;

[0071] Correspondingly, the actual execution statement of this data query statement is equivalent to'select * from t1 where id =1 or 1=1', which is used to query all data in table t1.

[0072] In addition, the attacker can also maliciously operate on the database through multi-statement SQL injection by tampering with and writing multiple SQL statements in the string param1. For example, the content of the string param1 can be tampered with to param1 :=‘1;truncate table t1’. At this time, the executed data query statement is as follows:

[0073] param1 := ‘1;truncate table t1’;

[0074] v_sql := 'select * from t1 where id = '|| param1;

[0075] execute v_sql;

[0076] Correspondingly, the actual execution statement of this data query statement is equivalent to'select * from t1 where id =1;truncate table t1', which is used to find data where id = 1 and empty the data in table t1.

[0077] Currently, generally in order to reduce the risk of SQL injection, it is necessary to write complex checking logic for the application program interacting with the database. However, this method increases the performance consumption of the application program, resulting in a decrease in the execution efficiency of the application program. In addition, due to the diverse and complex inputs of SQL injection and the fact that the checking logic mainly relies on simple rules for defense, the existing methods have poor effects in identifying the risk of SQL injection.

[0078] In view of this, the present application provides a data processing method. After replacing the input parameters in the SQL statement with placeholders, semantic analysis is performed on the SQL statement to determine the data type of the placeholder. Then, according to whether the data type of the placeholder matches the data type of the input parameter, it is determined whether there is a risk of SQL injection in the SQL statement. If they do not match, a first prompt message is output to remind of the risk of SQL injection. Compared with the method in the prior art that requires writing complex checking logic for the application program interacting with the database, the present application does not need to write additional complex checking logic, thereby reducing the performance consumption of the application program and improving the effect of identifying the risk of SQL injection.

[0079] Next, taking Figure 1 as an example, the technical solution of the present application and how the technical solution of the present application solves the above technical problems will be described in detail through specific embodiments. These specific embodiments below can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0080] Figure 2 It is a schematic flowchart of a data processing method provided by an embodiment of the present application. As Figure 2 shown, the method includes:

[0081] S201. Obtain a first SQL statement of the database.

[0082] Among them, the first SQL statement includes input parameters. The input parameter is used to determine the operation to be executed by the first SQL statement. For example, it can be the content of the aforementioned string param1 (i.e., the value corresponding to param1).

[0083] Optionally, the first SQL statement can be obtained in response to a user instruction or user input, or can be received from other devices. For example, a first SQL statement containing input parameters can be generated and obtained from user input, a configuration file, or the internal logic of the program.

[0084] S202. Replace the input parameters in the first SQL statement with placeholders to generate a second SQL statement corresponding to the first SQL statement.

[0085] Among them, a placeholder is a special symbol or marker widely used in scenarios such as programming, text processing, and various data operation scenarios. It is used to reserve a value at a certain position and fill in the specific content during subsequent processing. This placeholder can be represented by, for example, "?", or can be represented by any other symbol, etc. This application does not limit this.

[0086] In this step, string processing techniques can be utilized. By using the string search and replacement functions in a programming language, locate the position of the input parameter in the first SQL statement and replace it with a specific placeholder (such as "?") to generate a second SQL statement corresponding to the first SQL statement. For example, in Python, the replace method of the string or regular expressions can be used to accurately match and replace the input parameter, thereby generating the second SQL statement.

[0087] Exemplarily, taking the following as the first SQL statement:

[0088] param1 := 1;

[0089] v_sql := 'select*from t1 where id ='|| param1;

[0090] execute v_sql;

[0091] The second SQL statement generated after replacement can be:

[0092] param1 :=?;

[0093] v_sql := 'select*from t1 where id ='|| param1;

[0094] execute v_sql;

[0095] This second SQL statement can ensure that the semantics of the SQL statement itself do not change.

[0096] S203. Obtain the data type corresponding to the placeholder according to the semantics of the second SQL statement.

[0097] A possible implementation manner is to parse the second SQL statement to obtain the corresponding syntax tree. For example, an SQL syntax parser such as ANTLR (ANother Tool for Language Recognition) can be used to parse the second SQL statement to obtain the corresponding syntax tree. Among them, each node of the syntax tree represents a syntax element in the second SQL statement, and the node where the placeholder is located can be found by traversing the syntax tree. Then, determine the data type of the placeholder according to the attributes of this node.

[0098] For example, assume that a placeholder appears in a conditional statement like "WHERE column_name =?". By analyzing the attributes of the "column_name" node, its data type is determined, and thus the data type corresponding to the placeholder is obtained. Assume that "column_name" is "product_id", which is defined as an INTEGER type in the database table structure. Then the data type corresponding to the placeholder is the INTEGER type.

[0099] Another possible implementation way is to utilize database metadata to obtain the data type corresponding to the placeholder. For example, through the interface provided by the database management system to obtain metadata, the table structure, column information, etc. in the database can be queried, and the table and column where the placeholder is located can be determined. Then, query the database metadata to obtain the data type of this column.

[0100] S204. If the data type of the input parameter does not match the data type corresponding to the placeholder, then output the first prompt message.

[0101] Among them, the first prompt message is used to prompt that there is a risk in the first SQL statement. For example, it is used to prompt the user that there are risks such as malicious tampering and SQL injection in the first SQL statement.

[0102] Since SQL injection mainly changes the semantics of the SQL statement or concatenates multiple statements by concatenating strings within the input parameter, the SQL statement with SQL injection risk usually cannot match the data type of the input parameter of the original SQL statement. For example, in the previous example, param1 :=1, the data type of this input parameter is int, while the maliciously tampered SQL statement can be, for example, param1 := ‘1;truncate table t1’ or param1 := ‘1 or 1=1’, and the data type of its input parameter is string. Therefore, if the data type of the input parameter does not match the data type corresponding to the placeholder, it indicates that there is a high probability of malicious tampering risk in the first SQL statement.

[0103] One possible implementation way is to directly compare whether the data type of the input parameter is the same as the data type corresponding to the placeholder. If they are different, it is a mismatch.

[0104] Another possible implementation way is to determine whether the data type of the input parameter matches the data type corresponding to the placeholder by performing data type conversion. For example, the input parameter can be converted to the data type corresponding to the placeholder. If the conversion is successful, it indicates a match; if the conversion is unsuccessful, it indicates a mismatch.

[0105] In this step, the logging function of the application program interacting with the database or the user interface can be used to output the first prompt message to be presented to the user or logged in the log file, informing the user that there is a risk in the first SQL statement. For example, in a Web application, the user can be prompted through a page pop-up window or log file recording.

[0106] The method provided by the embodiment of the present application generates a second SQL statement corresponding to the first SQL statement by obtaining the first SQL statement of the database and replacing the input parameters in the first SQL statement with placeholders. According to the semantics of the second SQL statement, the data type corresponding to the placeholder is obtained. If the data type of the input parameter does not match the data type corresponding to the placeholder, a first prompt message for prompting that there is a risk in the first SQL statement is output, thereby reducing the performance consumption of the application program and improving the effect of identifying SQL injection risks.

[0107] Next, two implementation methods for specifically determining whether the data type of the input parameter matches the data type corresponding to the placeholder are introduced in detail.

[0108] Method A: Determine whether the data type of the input parameter is the same as the data type corresponding to the placeholder.

[0109] If the data type of the input parameter is different from the data type corresponding to the placeholder, the first prompt message is output.

[0110] In this method, the data type of the input parameter of the first SQL statement can be obtained through a programming language. For example, in Python, the type() function can be used to directly obtain the data type of the input parameter (assuming the input parameter is input_value = 10, using type(input_value) will return <class 'int'>, clearly indicating that the data type of this value is an integer type. If the value of the input parameter is a string, such as input_value = "hello", then type(input_value) returns <class'str'>), etc. It should be understood that only Python language is used as an example for introduction here, and it is not specifically limited to this programming language.

[0111] After obtaining the data type of the input parameter, by comparing it with the data type corresponding to the placeholder obtained in the previous step S203, it can be determined whether the two are the same. If they are the same, it indicates a match; if they are different, it indicates a mismatch. When the data type of the input parameter does not match the data type corresponding to the placeholder, the first prompt message can be output.

[0112] Method B: Determine whether the data type of the input parameter matches the data type corresponding to the placeholder by means of data type conversion.

[0113] Figure 3 This is a flowchart showing another data processing method provided by an embodiment of this application. As Figure 3 shown, the aforementioned step S204 may specifically include:

[0114] S301. Perform data type conversion on the input parameter according to the data type corresponding to the placeholder.

[0115] Performing conversion on the input parameter according to the data type corresponding to the placeholder depends on the data type conversion functions or methods provided by the programming language. For example, in JavaScript, if the data type corresponding to the placeholder is "number" (assuming the mapping of numerical types in the database) and the input parameter is a numeric string "123", the parseFloat() or parseInt() functions can be used for conversion. Different programming languages have their own methods for different data type conversions. Functions such as int() and float() in Python can be used for the conversion of basic data types, etc.

[0116] S302. If the data type conversion fails, output a first prompt message.

[0117] After completing the data type conversion, it is necessary to determine whether the conversion is successful. In many programming languages, a failed data type conversion will throw an exception or return a specific error value. For example, in Java, when attempting to convert a non-numeric string to an integer, the Integer.parseInt() method will throw a NumberFormatException. The conversion failure can be determined by catching the exception.

[0118] If the conversion is successful, it indicates that the data type of the input parameter matches the data type corresponding to the placeholder, and there is no risk of SQL injection. If the conversion fails, it indicates that the data type of the input parameter does not match the data type corresponding to the placeholder, and there is a risk of tampering with the input value of the input parameter, that is, there is a risk of SQL injection.

[0119] Exemplarily, if it is determined by the semantics of the second SQL statement that the data type corresponding to the placeholder is the int type, and the data type of the input value of the input parameter of the first SQL statement is the string type, then when performing conversion on the input parameter according to the data type corresponding to the placeholder, it will be recognized that the input value of the input parameter is not of the int type, and there is a risk of tampering with the input value of the input parameter, that is, there is a risk of SQL injection.

[0120] Next, a detailed introduction will be given on how to obtain the data type corresponding to the placeholder according to the second SQL statement in the aforementioned step S203. Figure 4It is a schematic flowchart of another data processing method provided by an embodiment of this application. As Figure 4 shown, the foregoing step S203 may specifically include:

[0121] S401. Perform semantic analysis on the second SQL statement to determine the identifier corresponding to the placeholder in the second SQL statement.

[0122] A possible implementation manner is that a lexical analyzer can be used to split the second SQL statement into multiple lexical units, such as keywords (e.g., SELECT, FROM, WHERE, etc.), identifiers (table names, column names, etc.), operators (e.g., =, >, <, etc.), and constants. Then, a syntax analyzer constructs a syntax tree based on the syntax rules of the SQL language. During the process of traversing the syntax tree, when a placeholder node is encountered, the identifier associated with it is determined by analyzing its context information. For example, in the SQL statement "SELECT column1, column2 FROM table1 WHERE column1 =?", after the syntax analyzer constructs the syntax tree, it can trace upward from the placeholder node in the WHERE clause to determine that "column1" is the identifier corresponding to this placeholder.

[0123] Another possible implementation manner is that a semantic pattern matching method can be used to determine the identifier corresponding to the placeholder in the second SQL statement. Specifically, some common SQL semantic patterns, such as query statement patterns, insert statement patterns, etc., can be predefined. The second SQL statement is matched with these patterns, and the identifier corresponding to the placeholder is determined according to the matching pattern rules. For example, for a simple query pattern "SELECT <columns>FROM <condition>” When the placeholder is recognized in the conditions of the WHERE clause in the SQL statement, according to the pattern rules, it can be determined that the identifier related to the placeholder is the column name in the condition.

[0124] S402. Obtain the data type of the identifier.

[0125] In this step, the data type of the identifier can be obtained according to the identifier and the mapping relationship between the identifier and the data type. The mapping relationship between the identifier and the data type can be preset or obtained from other electronic devices, etc., and the present application does not limit this.

[0126] In a possible implementation manner, taking the mapping relationship between the identifier and the data type being stored in the data table structure information in the database as an example, this implementation manner can be specifically implemented through the following sub-steps:

[0127] S4021. Obtain the data table structure information in the database.

[0128] Among them, the data table structure information includes the association relationship among the data table, the data column, and the data type.

[0129] Obtaining the data table structure information in the database aims to clearly master the association relationship among the data table, the data column, and the data type in the database, laying a foundation for subsequently determining the data type of the identifier.

[0130] For a relational database, in addition to the common method of querying the system table, the data table structure information in the database can also be obtained by means of the interface provided by the database management tool. For example, through the database management tool, a graphical interface or a specific command-line tool can be used to obtain the database structure information. These tools internally implement a mechanism for interacting with the database and can convert the user's operations into underlying database query instructions, thereby obtaining the data table structure information.

[0131] For a non-relational database, the structure can be inferred by traversing the collections in the database (similar to the tables in a relational database) and analyzing the field information of each document (similar to the rows in a table). Or the data table structure information in the database can be obtained by analyzing the naming rules of the keys and the storage format of the values in the key-value pair database, etc.

[0132] S4022. According to the data table structure information and the identifier, obtain the data type of the identifier.

[0133] After obtaining the data table structure information, match the identifier with the column name by traversing the obtained list of data table structure information. For example, the data table structure information obtained in MySQL is returned in the form of a result set. Assume that each row of data in the result set represents the information of a column, including the table name, column name, and data type. When obtaining the data type of the identifier "column1", traverse the result set to find the row where the column name matches "column1", and the value of the "DATA_TYPE" field in this row is the data type of the identifier.

[0134] S403. Obtain the data type corresponding to the placeholder according to the data type of the identifier.

[0135] A possible implementation method is to directly use the data type of the identifier as the data type corresponding to the placeholder. In an SQL statement, a placeholder is a symbol used to replace an input parameter, and its function is to provide a specific value during execution. An identifier usually represents a column in a database, and the statement fragment where the placeholder is located is an operation condition constructed around the identifier. Therefore, semantically and logically, the placeholder should be consistent with the data type of the identifier. Thus, the data type of the identifier can be used as the data type corresponding to the placeholder.

[0136] Another possible implementation method is to determine the data type corresponding to the placeholder according to the identifier and the operator corresponding to the identifier. Among them, the operator determines the data type requirements for the data involved in the operation. Different operators have specific restrictions on the data types on both sides of them. It is difficult to accurately determine the placeholder type based only on the data type of the identifier. By combining the identifier and the operator, the data type corresponding to the placeholder can be accurately determined according to the operation semantics and rules, ensuring the correct semantics of the SQL statement and the correct operation logic. Specifically, this implementation method can be realized through the following sub-steps:

[0137] S4031. Determine the operator corresponding to the identifier according to the identifier.

[0138] A possible implementation method is to record the association between the identifier and the operator during the construction of the syntax tree. For example, in the SQL statement "SELECT column1 +? FROM table1", during the construction of the syntax tree, "column1" and "+" can be recorded as related nodes, so as to determine that the operator corresponding to the identifier "column1" is "+".

[0139] Another possible implementation method is to determine the operator corresponding to the identifier through string pattern matching. For example, some common patterns can be defined to match the combination of the identifier and the operator. Exemplarily, the pattern " <identifier> <operator> <placeholder>", the operator corresponding to the identifier is found by matching this pattern in the second SQL statement. For example, for a statement like "column2>?", the operator corresponding to the identifier "column2" can be determined as ">" through pattern matching.

[0140] S4032. Obtain the data type corresponding to the placeholder based on the semantics of the operator and the data type of the identifier.

[0141] Among them, the semantics of the operator and the data type of the identifier jointly determine the data type corresponding to the placeholder. Different operators have specific requirements for the data types participating in the operation.

[0142] For example, for the addition operator "+", if the data type of the identifier is "INTEGER", then according to the rules of mathematical operations, the data type corresponding to the placeholder should also be "INTEGER" or a type that can be implicitly converted to "INTEGER", such as "SMALLINT". In the SQL statement "SELECT column1 +? FROM table1", if the data type of "column1" is "INTEGER", then the data type corresponding to the placeholder should also be a numeric type to ensure the correctness of the addition operation.

[0143] Another example is for the comparison operator "=", if the data type of the identifier is "VARCHAR", then the data type corresponding to the placeholder should usually also be "VARCHAR" because when performing string comparisons, the data types on both sides need to be the same. For example, in "SELECT * FROM table1 WHERE column2 =?", if the data type of "column2" is "VARCHAR", then the data type corresponding to the placeholder is also "VARCHAR". In this way, based on the semantics of the operator and the data type of the identifier, the data type corresponding to the placeholder is accurately obtained.

[0144] For another example, for the multiplication operator "*", it is used to perform mathematical multiplication operations. When different data types participate in the multiplication operation, certain rules need to be satisfied. If the data type of the identifier "discount_percentage" is "DECIMAL", in the SQL statement "SELECT * FROM products WHERE discount_percentage *? > 10", according to the multiplication operation rules, the data type corresponding to the placeholder should usually also be a numeric type. However, due to the data type implicit conversion mechanism of the database system, in most cases, the "INTEGER" type can be implicitly converted to the "DECIMAL" type to meet the requirements of the multiplication operation. Therefore, in this statement, even if the data type of the identifier "discount_percentage" is "DECIMAL", the data type corresponding to the placeholder can also be "INTEGER".

[0145] The method provided by the embodiment of the present application determines the identifier corresponding to the placeholder in the second SQL statement by performing semantic analysis on the second SQL statement, obtains the data type of the identifier, and obtains the data type corresponding to the placeholder according to the data type of the identifier. This embodiment provides a data basis for subsequently determining whether the data type of the input parameter matches the data type of the identifier. If they do not match, the first prompt message is output to remind of the SQL injection risk. Compared with the method in the prior art that requires writing complex inspection logic for the application program interacting with the database, the present application does not need to write complex inspection logic additionally, thereby reducing the performance consumption of the application program and improving the effect of identifying the SQL injection risk.

[0146] Figure 5 It is a schematic flowchart of another data processing method provided by the embodiment of the present application. As Figure 5 shown, the method may further include:

[0147] S501. Perform syntax analysis on the second SQL statement.

[0148] Among them, performing syntax analysis on the second SQL statement can ensure the correctness of the SQL statement, and it can check whether the second SQL statement conforms to the syntax rules of the SQL language.

[0149] In this step, syntax analysis can be performed through the existing syntax parser corresponding to the database. Among them, a syntax file can be predefined in the syntax parser, and the syntax file includes various syntax structures that describe SQL statements in detail, such as the combination rules of keywords, identifiers, operators, and constants. The second SQL statement is input into the syntax parser, and the syntax parser parses the statement according to the predefined rules and detects whether there are syntax errors in the second SQL statement, and specifically what syntax errors exist, such as keyword spelling errors, bracket mismatches, and whether multi-statement injection is included, thereby reducing the risk of multi-statement SQL injection and eliminating the need to add complex inspection logic specifically for SQL injection, thus reducing performance consumption.

[0150] Alternatively, the simple syntax checking function provided by the database driver can also be utilized. Currently, before executing an SQL statement, some database drivers will perform preliminary syntax verification. This verification is a basic function integrated within the driver and does not require developers to write additional complex logic. The driver will quickly determine whether the second SQL statement conforms to the basic syntax structure and complete the syntax analysis in a lightweight manner, avoiding performance losses caused by complex verification logic.

[0151] S502. If the analysis result of the syntax analysis passes, semantic analysis is performed on the second SQL statement.

[0152] If the analysis result of the syntax analysis passes, it indicates that there are no syntax anomalies in the second SQL statement, and the semantics of the second SQL statement can be further analyzed to determine whether there is an SQL injection risk through semantic analysis.

[0153] Specifically, for how to perform semantic analysis to determine whether there is an SQL injection risk, reference can be made to the foregoing Figures 2 - 4 embodiment, which will not be elaborated here.

[0154] After the syntax analysis passes, performing semantic analysis can further understand the meaning and intention of the SQL statement. Semantic analysis is usually based on the result of the syntax analysis.

[0155] S503. If the analysis result of the syntax analysis fails, the second prompt message is output.

[0156] Among them, the second prompt message is used to indicate that there is a syntax error in the first SQL statement.

[0157] If the parsing result of the syntax analysis fails, it indicates that there is an abnormality in the syntax of the second SQL statement. When there is an abnormality in the syntax of the second SQL statement, it will cause an execution abnormality of the second SQL statement, that is, the second SQL statement cannot be executed or the expected operation of the user cannot be achieved by executing the second SQL statement. Therefore, in this case, there is no need to perform subsequent semantic analysis to reduce the unnecessary performance overhead brought by semantic analysis, and directly output the second prompt message to prompt the user that there is a syntax abnormality in the second SQL statement.

[0158] Optionally, error information can be recorded during the syntax analysis process. When a syntax error is detected, information such as the location and type of the error is recorded. After the syntax analysis is completed, if there is a syntax error, the error information is converted into an easy-to-understand second prompt message for output. For example, output "There is a syntax error in the second SQL statement at the 10th character: the keyword 'FROM' is missing", etc.

[0159] Optionally, a series of error codes can also be defined according to common syntax error types. When a syntax error is detected, the corresponding error code is selected and output according to the error type. For example, for the error type of "unmatched parentheses", the second prompt message can be, for example, "There is a syntax error of type 02 in the second SQL statement at the 5th character". Among them, 02 is the error code corresponding to unmatched parentheses.

[0160] The method provided by the embodiments of the present application performs syntax analysis on the second SQL statement. If the parsing result of the syntax analysis passes, semantic analysis is performed on the second SQL statement. If the parsing result of the syntax analysis fails, the second prompt message is output. In this method, before executing the SQL statement, database syntax analysis is a necessary link in data processing. Therefore, there is no need to increase additional performance consumption, that is, the SQL injection risk of multiple statements is reduced through syntax analysis when executing the SQL statement. For SQL statements with syntax abnormalities, there is no need to perform subsequent semantic analysis to reduce the unnecessary performance overhead brought by semantic analysis, and directly output the second prompt message to prompt the user that there is a syntax abnormality in the second SQL statement, thereby further reducing the performance overhead and accuracy rate of SQL injection risk identification.

[0161] Figure 6 It is a schematic structural diagram of a data processing device provided by the embodiments of the present application. As Figure 6 shown, the device may include: a first acquisition module 11, a processing module 12, a second acquisition module 13, and a control module 14.

[0162] The first acquisition module 11 is used to acquire the first SQL statement of the database, and the first SQL statement includes input parameters.

[0163] A processing module 12 is configured to replace the input parameters in the first SQL statement with placeholders to generate a second SQL statement corresponding to the first SQL statement.

[0164] A second obtaining module 13 is configured to obtain the data type corresponding to the placeholder according to the semantics of the second SQL statement.

[0165] A control module 14 is configured to output a first prompt message if the data type of the input parameter does not match the data type corresponding to the placeholder, and the first prompt message is used to prompt that there is a risk in the first SQL statement.

[0166] Optionally, the control module 14 is specifically configured to output a first prompt message if the data type of the input parameter is different from the data type corresponding to the placeholder.

[0167] Optionally, the processing module 13 is specifically configured to perform data type conversion on the input parameter according to the data type corresponding to the placeholder. The control module 14 is specifically configured to output a first prompt message if the data type conversion fails.

[0168] Optionally, the second obtaining module 13 is specifically configured to perform semantic analysis on the second SQL statement to determine the identifier corresponding to the placeholder in the second SQL statement. Obtain the data type of the identifier. According to the data type of the identifier, obtain the data type corresponding to the placeholder.

[0169] Optionally, the second obtaining module 13 is specifically configured to obtain the data table structure information in the database, where the data table structure information includes the association relationship between the data table, the data column, and the data type. According to the data table structure information and the identifier, obtain the data type of the identifier.

[0170] Optionally, the second obtaining module 13 is specifically configured to determine the operator corresponding to the identifier according to the identifier. Based on the semantics of the operator and the data type of the identifier, obtain the data type corresponding to the placeholder.

[0171] Optionally, the processing module 13 is further configured to perform syntax analysis on the second SQL statement. If the analysis result of the syntax analysis passes, perform semantic analysis on the second SQL statement. If the analysis result of the syntax analysis fails, output a second prompt message, and the second prompt message is used to indicate that there is a syntax error in the first SQL statement.

[0172] The data processing device provided by the embodiment of the present application can execute the data processing method in the above method embodiment, and its implementation principle and technical effect are similar, which will not be elaborated here.

[0173] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present application. Among them, the electronic device is used to execute the data processing method described above. As Figure 7 shown, the electronic device 700 may include: at least one processor 701, a memory 702, and a communication interface 703.

[0174] The memory 702 is used to store programs. Specifically, the program may include program code, and the program code includes computer operation instructions.

[0175] The memory 702 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0176] The processor 701 is used to execute the computer execution instructions stored in the memory 702 to implement the method described in the foregoing method embodiments. Among them, the processor 701 may be a CPU, or a specific integrated circuit (Application Specific Integrated Circuit, abbreviated as ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0177] The processor 701 can communicate and interact with external devices through the communication interface 703. The external device may be, for example, other electronic devices, etc. In a specific implementation, if the communication interface 703, the memory 702, and the processor 701 are independently implemented, the communication interface 703, the memory 702, and the processor 701 may be interconnected through a bus and complete communication with each other. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc., but it does not mean that there is only one bus or one type of bus.

[0178] Optionally, in a specific implementation, if the communication interface 703, the memory 702, and the processor 701 are integrated on a chip, the communication interface 703, the memory 702, and the processor 701 may complete communication through an internal interface.

[0179] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0180] The present application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above method.

[0181] The above-readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, a magnetic disk or an optical disk. The readable storage medium can be any available medium accessible by a general-purpose or special-purpose computer.

[0182] An exemplary readable storage medium is coupled to the processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be part of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in a device.

[0183] The division of units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed coupling or direct coupling or communication connection between each other can be an indirect coupling or communication connection through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0184] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0185] In addition, in each embodiment of the present invention, the functional units can be integrated in a processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0186] If a function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs, etc., all kinds of media that can store program codes.

[0187] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When this program is executed, it executes the steps including the above method embodiments; and the aforementioned storage medium includes: ROMs, RAMs, magnetic disks, or optical discs, etc., all kinds of media that can store program codes.

[0188] Finally, it should be noted that: After considering the specification and practicing the invention disclosed herein, those skilled in the art will readily think of other implementation manners of the present invention. The present invention is intended to cover any variations, uses, or adaptations of the present invention, which follow the general principles of the present invention and include the common general knowledge or conventional technical means in the technical field not disclosed in the present invention. It is not limited to the exact structures described above and shown in the drawings, and various modifications and changes can be made without departing from its scope. The scope of the present invention is only limited by the appended claims.< / placeholder> < / operator> < / identifier> < / condition> WHERE < / columns>

Claims

1. A data processing method, characterized in that, Including: Obtain a first SQL statement of a database, where the first SQL statement includes input parameters; Replace the input parameters in the first SQL statement with placeholders to generate a second SQL statement corresponding to the first SQL statement; Obtain the data type corresponding to the placeholder according to the semantics of the second SQL statement; If the data type of the input parameter does not match the data type corresponding to the placeholder, output a first prompt message, where the first prompt message is used to prompt that there is a risk in the first SQL statement.

2. The method according to claim 1, characterized in that, The step of, if the data type of the input parameter does not match the data type corresponding to the placeholder, outputting a first prompt message, includes: If the data type of the input parameter is different from the data type corresponding to the placeholder, output the first prompt message.

3. The method according to claim 1, wherein If the data type of the input parameter does not match the data type corresponding to the placeholder, output a first prompt message, includes: Perform data type conversion on the input parameter according to the data type corresponding to the placeholder; If the data type conversion fails, output the first prompt message.

4. The method according to claim 2 or 3, characterized in that, The step of obtaining the data type corresponding to the placeholder according to the second SQL statement, includes: Perform semantic analysis on the second SQL statement to determine the identifier corresponding to the placeholder in the second SQL statement; Obtain the data type of the identifier; Obtain the data type corresponding to the placeholder according to the data type of the identifier.

5. The method according to claim 4, wherein The step of obtaining the data type of the identifier, includes: Obtain the data table structure information in the database, where the data table structure information includes the association relationship between the data table, the data column, and the data type; Obtain the data type of the identifier according to the data table structure information and the identifier.

6. The method according to claim 4, wherein The step of obtaining the data type corresponding to the placeholder according to the data type of the identifier, includes: Determine the operator corresponding to the identifier according to the identifier; Obtain the data type corresponding to the placeholder based on the semantics of the operator and the data type of the identifier.

7. The method according to any one of claims 1 to 3, characterized in that Further including: Perform syntax analysis on the second SQL statement; If the analysis result of the syntax analysis passes, perform semantic analysis on the second SQL statement; If the analysis result of the syntax analysis fails, output a second prompt message, where the second prompt message is used to indicate that there is a syntax error in the first SQL statement.

8. A data processing device, characterized in that, Including: A first obtaining module, configured to obtain a first SQL statement of a database, where the first SQL statement includes input parameters; A processing module, configured to replace the input parameters in the first SQL statement with placeholders to generate a second SQL statement corresponding to the first SQL statement; A second obtaining module, configured to obtain the data type corresponding to the placeholder according to the semantics of the second SQL statement; A control module, configured to, if the data type of the input parameter does not match the data type corresponding to the placeholder, output a first prompt message, where the first prompt message is used to prompt that there is a risk in the first SQL statement.

9. An electronic device, characterized in that, Including: A memory, a processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, such that the processor executes the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, There are stored computer-executable instructions, which, when executed, implement the method according to any one of claims 1-7.

Images