Ò׽ؽØÍ¼Èí¼þ¡¢µ¥Îļþ¡¢Ãâ°²×°¡¢´¿ÂÌÉ«¡¢½ö160KB

Java·ÀÖ¹SQL×¢Èë

 SQL×¢ÈëÊÇ×î³£¼ûµÄ¹¥»÷·½Ê½Ö®Ò»,Ëü²»ÊÇÀûÓòÙ×÷ϵͳ»òÆäËüϵͳµÄ©¶´À´ÊµÏÖ¹¥»÷µÄ,¶øÊdzÌÐòÔ±ÒòΪûÓÐ×öºÃÅжÏ,±»²»·¨
Óû§×êÁËSQLµÄ¿Õ×Ó,ÏÂÃæÎÒÃÇÏÈÀ´¿´ÏÂʲôÊÇSQL×¢Èë:
          ±ÈÈçÔÚÒ»¸öµÇ½½çÃæ,ÒªÇóÓû§ÊäÈëÓû§ÃûºÍÃÜÂë:
          Óû§Ãû:       ' or 1=1 --  
          ÃÜ       Âë:  
          µãµÇ½,ÈçÈôûÓÐ×öÌØÊâ´¦Àí,¶øÖ»ÊÇÒ»Ìõ´øÌõ¼þµÄ²éѯÓï¾äÈç:
          String sql="select * from users where username='"+userName+"' and password='"+password+"' "
          ÄÇôÕâ¸ö·Ç·¨Óû§¾ÍºÜµÃÒâµÄµÇ½½øÈ¥ÁË.(µ±È»ÏÖÔÚµÄÓÐЩÓïÑÔµÄÊý¾Ý¿âAPIÒѾ­´¦ÀíÁËÕâЩÎÊÌâ)
          ÕâÊÇÎªÊ²Ã´ÄØ?ÎÒÃÇÀ´¿´¿´ÕâÌõÓï¾ä,½«Óû§ÊäÈëµÄÊý¾ÝÌæ»»ºóµÃµ½ÕâÑùÒ»ÌõÓï¾ä:
          select * from users where username='' or 1=1 --' and password=''
          ΪÁ˸üÃ÷°×Щ£¬¿ÉÒÔ½«Æä¸´ÖƵ½SQL·ÖÎöÆ÷ÖУ¬½«»á·¢ÏÖ£¬ÕâÌõÓï¾ä»á½«Êý¾Ý¿âµÄÊý¾ÝÈ«²¿¶Á³öÀ´£¬ÎªÊ²Ã´ÄØ£¿
          ºÜ¼òµ¥,¿´µ½Ìõ¼þºóÃæ username='' or 1=1 Óû§ÃûµÈÓÚ '' »ò 1=1 ÄÇôÕâ¸öÌõ¼þÒ»¶¨»á³É¹¦£¬È»ºóºóÃæ¼ÓÁ½¸ö-£¬ÕâÒâζ×Å
ʲô£¿Ã»´í£¬×¢ÊÍ£¬Ëü½«ºóÃæµÄÓï¾ä×¢ÊÍ£¬ÈÃËûÃDz»Æð×÷Óã¬ÕâÑù¾Í¿ÉÒÔ˳ÀûµÄ°ÑÊý¾Ý¿âÖеÄÊý¾Ý¶ÁÈ¡³öÀ´ÁË¡£
          Õ⻹ÊDZȽÏÎÂÈáµÄ£¬Èç¹ûÊÇÖ´ÐÐ
          select * from users where username='' ;DROP Database      (DB Name) --' and password=''
          .......ÆäËûµÄÄú¿ÉÒÔ×Ô¼ºÏëÏ󡣡£¡£
          ÄÇôÎÒÃÇÔõôÀ´´¦ÀíÕâÖÖ


Ïà¹ØÎĵµ£º

java ¼¯ºÏ¿ò¼Ü(Collection)ºÍÊý×éµÄÅÅÐò

java ¼¯ºÏ¿ò¼Ü(Collection)ºÍÊý×éµÄÅÅÐò 
 ¸ù¾ÝÔ¼¶¨£¬ÔÚʹÓÃjava±à³ÌµÄʱºòÓ¦¾¡¿ÉÄܵÄʹÓÃÏÖÓеÄÀà¿â£¬µ±È»ÄãÒ²¿ÉÒÔ×Ô¼º±àдһ¸öÅÅÐòµÄ·½·¨£¬»òÕß¿ò¼Ü£¬µ«ÊÇÓм¸¸öÈËÄÜдµÃ±ÈJDKÀïµÄ»¹ÒªºÃÄØ£¿Ê¹ÓÃÏÖÓеÄÀàµÄÁíÒ»¸öºÃ´¦ÊÇ´úÂëÒ×ÓÚÔĶÁºÍά»¤£¬ÕâÆªÎÄÕÂÖ÷Òª½²µÄÊÇÈçºÎʹÓÃÏÖÓеÄÀà¿â¶ÔÊý×éºÍ¸÷ÖÖCollectionÈÝÆ÷½ø ......

´«ÖDz¥¿ÍJAVAÅàѵ2010 4 26SVN/CVS×ܽá

      ½ñÌìÎÒÔÚ×ö·É»ú¡£ÎªÊ²Ã´ËµÎÒÔÚ×ö·É»úÄØ£¡ÒòΪÕâÊÇÎÒ½ø´«ÖDz¥¿ÍÒÔÀ´£¬¸öÈ˸оõ·Ç³£ÖØÒªµÄÒ»ÌÿΣ¬µ«ÊÇÎÒ²»ÄÜÒ»ÏÂ×Ó¼ÇסËùËùÓеĶ«Î÷£¬×òÌìÍíÉÏ£¬¿´ÊÓÆµ¿´µ½ÍíÉÏÈýµã£¬½ñÌìÉϿκÜÏ뼯ÖÐ×¢ÒâÁ¦£¬µ«ÊÇ×îÖÕ»¹ÊÇÈ̲»×¡´òÁËî§Ë¯£¬µ«½ñÌìµÄµÄ¿Î¸øÎҵĸоõÊǷdz£¾ßÓÐÁ¬¹áÐÔ£¬Ç°ÃæµÄ¿ÎÈç¹ûÌýµÃ²»ÊǺÜÇ ......

select * into ºÍinsert into SQL SERVER

select * into destTbl from srcTbl
insert into destTbl(fld1, fld2) select fld1, 5 from srcTbl
ÒÔÉÏÁ½¾ä¶¼Êǽ« srcTbl µÄÊý¾Ý²åÈëµ½ destTbl£¬µ«Á½¾äÓÖÓÐÇø±ðµÄ£º
µÚÒ»¾ä£¨select into from£©ÒªÇóÄ¿±ê±í£¨destTbl£©²»´æÔÚ£¬ÒòΪÔÚ²åÈëʱ»á×Ô¶¯´´½¨¡£
µÚ¶þ¾ä£¨insert into select from£©ÒªÇóÄ¿±ê±í£¨dest ......

SQL server 2005ѧϰ±Ê¼Ç(ÊÓͼ)


Ò»£®ÊÓͼ(VIEW)
¶¨Ò壺ÊÓͼÊÇÒ»ÕÅÐéÄâµÄ±í£¬ÆäÄÚÈÝÊÇ´ÓÒ»ÕÅ»ò¶àÕűíÖвéѯµÃÀ´µÄ½á¹û¼¯¡£
ÃèÊö£ºÊÓͼÊÇ´æ´¢ÔÚϵͳĿ¼ÖеÄÐÅÏ¢£¬Ëý²¢Ã»ÓÐÕæÕý´æ´¢Êý¾Ý£¬¶øÊÇÒÑ´æ±íµÄͶӰ¡£ÊÓͼµÄÊôÐÔÊǰ´ÕÕÒ»¸ö²éѯµÄ¹æ¶¨´ÓÒ»¸ö»òÕß¶à¸ö±íÖе¼³öµÄ£¬ÊÇÒÑ´æ±íµÄ¹ýÂËÆ÷¡£ËýÊÇÒ»ÕÅ“Ðé±í”£¬´ÓÒ»Õűí»òÕß¶àÕűíÖÐÅÉÉú³öÀ´µÄ£¬Æä ......
© 2009 ej38.com All Rights Reserved. ¹ØÓÚE½¡ÍøÁªÏµÎÒÃÇ | Õ¾µãµØÍ¼ | ¸ÓICP±¸09004571ºÅ