C#.NET·ÀÖ¹SQL×¢Èëʽ¹¥»÷
1 ·ÀÖ¹sql×¢Èëʽ¹¥»÷(¿ÉÓÃÓÚUI²ã¿ØÖÆ£© #region ·ÀÖ¹sql×¢Èëʽ¹¥»÷(¿ÉÓÃÓÚUI²ã¿ØÖÆ£©
2
3 /**/ ///
4 /// ÅжÏ×Ö·û´®ÖÐÊÇ·ñÓÐSQL¹¥»÷´úÂë
5 ///
6 /// ´«ÈëÓû§Ìá½»Êý¾Ý
7 /// true-°²È«£»false-ÓÐ×¢Èë¹¥»÷ÏÖÓУ»
8 public bool ProcessSqlStr( string inputString)
9 {
10 string SqlStr = @" and|or|exec|execute|insert|select|delete|update|alter|create|drop|count|\*|chr|char|asc|mid|substring|master|truncate|declare|xp_cmdshell|restore|backup|net +user|net +localgroup +administrators " ;
11 try
12 {
13 if ((inputString != null ) && (inputString != String.Empty))
14 {
15 string str_Regex = @" \b( " + SqlStr + @" )\b " ;
16
17 Regex Regex = new Regex(str_Regex, RegexOptions.IgnoreCase);
18 // string s = Regex.Match(inputString).Value;
19 if ( true == Regex.IsMatch(inputString))
20 return false ;
21
22 &
Ïà¹ØÎĵµ£º
ϵͳ»·¾³£ºWindows 7
Èí¼þ»·¾³£ºVisual C++ 2008 SP1 +SQL Server 2005
±¾´ÎÄ¿µÄ£º±àдһ¸öº½¿Õ¹ÜÀíϵͳ
ÕâÊÇÊý¾Ý¿â¿Î³ÌÉè¼ÆµÄ³É¹û£¬ËäÈ»³É¼¨²»¼Ñ£¬µ«ÊÇ×÷ΪÎÒÓÃVC++ ÒÔÀ´±àдµÄ×î´ó³ÌÐò»¹ÊÇ´«µ½ÍøÉÏ£¬ÒÔ¹©²Î¿¼¡£ÓÃVC++ ×öÊý¾Ý¿âÉè¼Æ²¢²»ÈÝÒ×£¬µ«Ò²²»ÊDz»¿ÉÄÜ¡£ÒÔÏÂÊÇÎҵijÌÐò½çÃæ£¬ºóÃæ ......
ÓÉÓÚÐèҪʵÏÖÒÔϹ¦ÄÜ£º
Íø¹ØÍ¨¹ý´®¿Ú·¢ËÍÊý¾Ý¸øPC»ú£¬PC»úÊÕ¼¯Êý¾Ý²¢½âÎö±£´æµ½MySQLÖУ¬È»ºóJSPÒ³Ãæ¶ÁÈ¡MySQLÖеÄÊý¾Ý²¢ÏÔʾ¡£
ËùÒÔÀûÓÃC#Á¬½ÓMySQLÊý¾Ý³ÉΪÁ˱ØÐëÒª¾¹ýµÄ¹ý³Ì£¬Ôڴ˸øÓèÏêϸµÄ˵Ã÷¡£
1¡¢ÏÂÔØÐèÒªµÄÎļþMySQLDriverCS£¬ÏÂÔØµØÖ·Îª£ºhttp://sourceforge.net/projects/mysqldrivercs
2¡¢°²×°Îļþ£ºMySQ ......
Ò»¡¢±³¾°½éÉÜ
¡¡¡¡
¡¡¡¡½á¹¹»¯²éѯÓïÑÔ(Structured Query Language£¬¼ò³ÆSQL)ÊÇÓÃÀ´·ÃÎʹØÏµÐÍÊý¾Ý¿âÒ»ÖÖͨÓÃÓïÑÔ£¬ÊôÓÚµÚËÄ´úÓïÑÔ£¨4GL£©£¬ÆäÖ´ÐÐÌØµãÊǷǹý³Ì»¯£¬¼´²»ÓÃÖ¸Ã÷Ö´ÐеľßÌå·½·¨ºÍ;¾¶£¬¶øÊǼòµ¥µØµ÷ÓÃÏàÓ¦Óï¾äÀ´Ö±½ÓÈ¡µÃ½á¹û¼´¿É¡£ÏÔÈ»£¬ÕâÖÖ²»¹Ø×¢ÈκÎʵÏÖϸ½ÚµÄÓïÑÔ¶ÔÓÚ¿ª·¢ÕßÀ´ËµÓÐ׿«´óµÄ±ãÀû¡£È»¶ø£¬Ó ......
ÔÎĵØÖ·£ºhttp://www.eygle.com/case/Use.sql_trace.to.Diagnose.database.htm
SQL_TRACEÊÇOracleÌṩµÄÓÃÓÚ½øÐÐSQL¸ú×ÙµÄÊֶΣ¬ÊÇÇ¿ÓÐÁ¦µÄ¸¨ÖúÕï¶Ï¹¤¾ß.ÔÚÈÕ³£µÄÊý¾Ý¿âÎÊÌâÕï¶ÏºÍ½â¾öÖУ¬SQL_TRACEÊǷdz£³£Óõķ½·¨¡£
±¾ÎľÍSQL_TRACEµÄʹÓÃ×÷¼òµ¥Ì½ÌÖ£¬²¢Í¨¹ý¾ßÌå°¸Àý¶Ôsql_traceµÄʹÓýøÐÐ˵Ã÷.
Ò»¡¢ »ù´¡½éÉÜ
(a) ......
ÔÚsql²éѯ·ÖÎöÆ÷ÀïÃæÊDz»ÄÜÖ±½ÓÔËÐÐcmdÃüÁîµÄ
µ«ÊÇSQL¸ø³öÁËÒ»¸ö½Ó¿Ú
--´ò¿ª¸ß¼¶ÉèÖÃ
EXEC sp_configure 'show advanced options', 1
RECONFIGURE
--´ò¿ªxp_cmdshellÀ©Õ¹´æ´¢¹ý³Ì
EXEC sp_configure 'xp_cmdshell', 1
RECONFIGURE
Ê×ÏÈ ´ò¿ªÒ»Ð©ÅäÖÃ
È»ºóÖ´ÐÐÄãÒªÔËÐÐcmdÃüÁî
exec master..xp_cmdshell 'net star ......