[MySQLÓÅ»¯] ÈçºÎʹÓÃSQL Profiler ÐÔÄÜ·ÖÎöÆ÷
[MySQLÓÅ»¯] -- ÈçºÎʹÓÃSQL Profiler ÐÔÄÜ·ÖÎöÆ÷
ʱ¼ä:2010-2-28À´Ô´:HaCMS¿ªÔ´ÉçÇø ×÷Õß:diesou
mysql µÄ sql ÐÔÄÜ·ÖÎöÆ÷Ö÷ÒªÓÃ;ÊÇÏÔʾ sql Ö´ÐеÄÕû¸ö¹ý³ÌÖи÷Ïî×ÊÔ´µÄʹÓÃÇé¿ö¡£·ÖÎöÆ÷¿ÉÒÔ¸üºÃµÄչʾ³ö²»Á¼ SQL µÄÐÔÄÜÎÊÌâËùÔÚ¡£ ÏÂÃæÎÒÃǾÙÀý½éÉÜһϠMySQL SQL Profiler µÄʹÓ÷½·¨£º Ê×ÏÈ£¬¿ªÆô MySQL SQL Profiler mysql> SELECT @@profiling; +------- ...
mysql µÄ sql ÐÔÄÜ·ÖÎöÆ÷Ö÷ÒªÓÃ;ÊÇÏÔʾ sql Ö´ÐеÄÕû¸ö¹ý³ÌÖи÷Ïî×ÊÔ´µÄʹÓÃÇé¿ö¡£·ÖÎöÆ÷¿ÉÒÔ¸üºÃµÄչʾ³ö²»Á¼ SQL µÄÐÔÄÜÎÊÌâËùÔÚ¡£
ÏÂÃæÎÒÃǾÙÀý½éÉÜһϠMySQL SQL Profiler µÄʹÓ÷½·¨£º
Ê×ÏÈ£¬¿ªÆô MySQL SQL Profiler
mysql> SELECT @@profiling;
+-------------+
| @@profiling |
+-------------+
| 0 |
+-------------+
1 row in set (0.00 sec)
mysql> SET profiling = 1;
Query OK, 0 rows affected (0.00 sec)
mysql> SELECT @@profiling;
+-------------+
| @@profiling |
+-------------+
| 1 |
+-------------+
1 row in set (0.00 sec)
ĬÈÏÇé¿öÏ profiling µÄֵΪ 0 ±íʾ MySQL SQL Profiler ´¦ÓÚ OFF ״̬£¬¿ªÆô SQL ÐÔÄÜ·ÖÎöÆ÷ºó profiling µÄֵΪ 1.
ͨ¹ý sql ÐÔÄÜ·ÖÎöÆ÷£¬ÎÒÃÇÀ´¶Ô±ÈһϠÏÂÁÐÓï¾äǰºó 2 ´ÎÖ´Ðйý³ÌµÄ²îÒ죬¶ÔÎÒÃÇÁ˽â sql µÄÏêϸִÐйý³ÌÊǷdz£ÓаïÖúµÄ¡£
mysql> create table t_engines select * from t_engines1;
Query OK, 57344 rows affected (0.10 sec)
Records: 57344 Duplicates: 0 Warnings: 0
mysql> select count(*) from t_engines;
+----------+
| count(*) |
+----------+
| 57344 |
+----------+
1 row in set (0.00 sec)
mysql> select count(*) from t_engines;
+----------+
| count(*) |
+----------+
| 57344 |
+----------+
1 row in set (0.00 sec)
mysql> SHOW PROFILES;
+----------+------------+-------------------------------------------------+
| Query_ID | Duration | Query |
+----------+------------+-------------------------------------------------+
| 26 | 0.
Ïà¹ØÎĵµ£º
set ANSI_NULLS ON
set QUOTED_IDENTIFIER ON
go
ALTER PROCEDURE [dbo].[PE011_Page]
@TableName varchar(50), --±íÃû
@Fields varchar(5000) = '*', --×Ö¶ÎÃû(È«²¿×Ö¶ÎΪ*)
@OrderField varchar(5000), &n ......
¸ù¾ÝÄãµÄʹÓÃÄ¿µÄÎÒ¾õµÃÕâ¸öº¯ÊýÓÐÁ½·½ÃæµÄÓÃ;£º
·ÀÖ¹SQL Injection¹¥»÷£¬Ò²¾ÍÊÇÄã±ØÐëÑéÖ¤Óû§µÄÊäÈë
²Ù×÷Êý¾ÝµÄʱºò±ÜÃâ²»±ØÒªµÄ×Ö·ûµ¼Ö´íÎó
mysql_real_escape_string() º¯ÊýתÒå SQL Óï¾äÖÐʹÓõÄ×Ö·û´®ÖеÄÌØÊâ×Ö·û¡£
ÏÂÁÐ×Ö·ûÊÜÓ°Ï죺
\x00
\n
\r
\
'
"
\x1a
Èç¹û³É¹¦£¬Ôò¸Ãº¯Êý·µ»Ø±»×ªÒåµÄ×Ö·û´ ......
±ÈÈ磺
insert into User values(x1,x2,x3,x4),(x1,x2,x3,x4),(x1,x2,x3,x4)
ÕâÖÖд·¨£¬ÁÐÊýÁ¿±ØÐëºÍ±íÖÐËùÓÐÁб£³ÖÒ»Ö£¬Ò²¾ÍÊÇ˵Áж¼ÒªÁгöÀ´¡£
Õâ¸öuser±íÀïÃæµÄÒ»¸ö×Ö¶Îx1ÊǸö×ÔÔö³¤×ֶΣ¬ÔòÓ¦¸ÃÌînullռλ
insert into User values(null,x2,x3,x4),(null,x2,x3,x4),(null,x2,x3,x4)
·ñÔò»á±¨´í¡£ ......
Ê×ÏÈ˵Ã÷Ò»µã£ºVC³ÌÐòÖÐÓÃADOÁ¬½ÓSQL Server 2005 ºÍÁ¬½Ó SQL Server 2000µÄÓï¾äºÍÁ¬½Ó×Ö·û´®ÊÇÍêȫһÑùµÄ£¬ÏÂÃæµÄ´úÂëÊÊÓÃÓÚÁ½¸öÊý¾Ý¿âµÄÁ¬½Ó¡£
ÁíÒ»µã˵Ã÷£ºÈç¹ûÄãÒÔǰ°²×°¹ýSQL Server 2000£¬ºóÔÚûÓÐÐ¶ÔØµÄÇé¿öÏÂÓÖ°²×°ÁË2005£¬ÄÇôÄã֮ǰÔÚ2000ÖÐÉèÖõÄÓû§ÃûºÍÃÜÂëÔÚ2005Öлᱣ³Ö£¬¼´Ê¹Äã°²×°2005ʱδÉèÖÃÈκÎÓû§Ãû ......