sql server注入

A SQL injection attack is one of the most commonly used hacking techniques. It allows hacks to access information from a database that is otherwise not publically accessible.

SQL注入攻击是最常用的黑客技术之一。 它使黑客可以访问数据库中的信息，否则该数据库将无法公开访问。

Owing to its simplicity, SQL injection is one of the most popular database hacking techniques.

由于其简单性，SQL注入是最流行的数据库黑客技术之一。

In this article, you will see how SQL injection works with the help of examples, and also how to prevent a SQL injection attack.

在本文中，您将借助示例了解SQL注入的工作方式，以及如何防止SQL注入攻击。

创建一个虚拟数据库 (Create a dummy database)

The following script creates a dummy database named BookStore with one table i.e. Books. The Books table has four columns: id, name, category, and price:

以下脚本使用一个表（即Books）创建一个名为BookStore的虚拟数据库。 Books表包含四列： id ， name ， category和price ：

CREATE Database BookStore;
GO
USE BookStore;
CREATE TABLE Books
(
id INT,
name VARCHAR(50) NOT NULL,
category VARCHAR(50) NOT NULL,
price INT NOT NULL
)

Let’s now add some dummy records in the Books table:

现在让我们在Books表中添加一些虚拟记录：

USE BookStoreINSERT INTO Books
VALUES
(1, 'Book1', 'Cat1', 1800),
(2, 'Book2', 'Cat2', 1500),
(3, 'Book3', 'Cat3', 2000),
(4, 'Book4', 'Cat4', 1300),
(5, 'Book5', 'Cat5', 1500),
(6, 'Book6', 'Cat6', 5000),
(7, 'Book7', 'Cat7', 8000),
(8, 'Book8', 'Cat8', 5000),
(9, 'Book9', 'Cat9', 5400),
(10, 'Book10', 'Cat10', 3200)

The above script adds 10 dummy records in the Books table.

上面的脚本在Books表中添加了10条虚拟记录。

什么是SQL注入攻击？ (What is the SQL injection attack?)

A SQL injection attack takes advantage of a vulnerability in a web application that allows hackers to modify the queries that are being executed on the underlying database. Web applications that directly execute user inputs as a query are those that fall prey to SQL injections. This allows attackers to execute malicious queries, also known as malicious payloads on database servers.

SQL注入攻击利用Web应用程序中的漏洞，使黑客可以修改在基础数据库上执行的查询。 直接作为查询执行用户输入的Web应用程序是那些容易受到SQL注入攻击的应用程序。 这使攻击者可以执行恶意查询，也称为数据库服务器上的恶意有效负载。

Let’s see a very simple example of how a SQL injection attack can be executed on a database server. Consider a scenario where you have a web application that accesses the BookStore database that we created in the last section. Your web application has a search box where a user can enter the name of a book and, if the book exists, the id, name, and price of the book is shown on the webpage.

让我们看一个非常简单的示例，说明如何在数据库服务器上执行SQL注入攻击。 考虑一种情况，您有一个Web应用程序可以访问我们在上一节中创建的BookStore数据库。 您的Web应用程序具有一个搜索框，用户可以在其中输入一本书的名称，如果该书存在，则该书的ID，名称和价格会显示在网页上。

One way to return the book searched by a user is via sp_executesql stored procedure that executes the SQL query in the form of a string. Here is an example of that:

返回用户搜索的书的一种方法是通过sp_executesql存储过程，该存储过程以字符串形式执行SQL查询。 这是一个例子：

DECLARE @BookName NVARCHAR(128)
DECLARE @SQL_QUERY NVARCHAR (MAX)
SET @BookName = '''Book6'''
SET @SQL_QUERY =N'SELECT id, name, price FROM Books WHERE name = '+ @BookName
EXECUTE sp_executesql @SQL_QUERY

Here we declare two variables @SQL_QUERY and @BookName. The name of the book entered by the user in the search box of the web application is stored in the @BookName variable. The @SQL_QUERY contains the select query which returns the book name where the name is equal to the value in the @BookName variable. Finally, the sp_executesql query is used to execute the @SQL_QUERY. Here is the result.

在这里，我们声明两个变量@SQL_QUERY和@BookName。 用户在Web应用程序的搜索框中输入的书名存储在@BookName变量中。 @SQL_QUERY包含选择查询，该查询返回书名，该书名与@BookName变量中的值相等。 最后，使用sp_executesql查询执行@SQL_QUERY。 这是结果。

We get the desired result but the above query is vulnerable to SQL injection. There are different ways in which SQL injection can be executed via the above query.

我们得到了期望的结果，但是上面的查询容易受到SQL注入的攻击。 通过上述查询可以执行SQL注入的方式有多种。

We will discuss two of the simplest and most commonly used ways below.

我们将在下面讨论两种最简单，最常用的方法。

1.通过1 = 1进行SQL注入 (1. SQL injection via 1 = 1)

SQL injection can be executed by concatenating 1 = 1 using the OR clause in a search query.

可以通过在搜索查询中使用OR子句将1 = 1串联来执行SQL注入。

Let’s see an example of this:

让我们看一个例子：

DECLARE @BookName NVARCHAR(128)
DECLARE @SQL_QUERY NVARCHAR (MAX)
SET @BookName = '''Book6'' OR 1 = 1'
SET @SQL_QUERY =N'SELECT id, name, price FROM Books WHERE name = '+ @BookNameEXECUTE sp_executesql @SQL_QUERY

In the above script, the search query is “Book 6 or 1 = 1”. This query will return true for all the rows in the Books table since 1 = 1 will return true for all the rows. Therefore all the results in the Books table will be displayed. Here is the output:

在上面的脚本中，搜索查询为“ Book 6 or 1 = 1”。 该查询将对Books表中的所有行返回true，因为1 = 1将对所有行返回true。 因此，将显示“书籍”表中的所有结果。 这是输出：

This might not be a problem for the Books table but if you have a table containing the user names and passwords of your users, the retrieval of all of their user names and passwords is a business-critical issue.

对于Books表，这可能不是问题，但是如果您有一个包含用户的用户名和密码的表，则检索他们所有的用户名和密码将成为业务关键问题。

2.通过“” =“”进行SQL注入 (2. SQL injection via “” = “”)

Another common way to execute a SQL injection attack is by appending “”=”” using an OR clause at the end of the search query. Again, this will also always return true.

执行SQL注入攻击的另一种常见方法是在搜索查询的末尾使用OR子句附加“” =”。 同样，这也将始终返回true。

Here is an example:

这是一个例子：

DECLARE @BookName NVARCHAR(128)
DECLARE @SQL_QUERY NVARCHAR (MAX)
SET @BookName = '''Book6'' OR '''' = '''''
SET @SQL_QUERY =N'SELECT id, name, price FROM Books WHERE name = '+ @BookName
EXECUTE sp_executesql @SQL_QUERY

防止SQL注入 (Preventing SQL injection)

The best way to prevent a SQL injection is to use parameterized queries rather than directly embedding the user input in a query string. Let’s see how an SQL injection can be prevented via a parameterized query:

防止SQL注入的最佳方法是使用参数化查询，而不是直接将用户输入嵌入查询字符串中。 让我们看看如何通过参数化查询防止SQL注入：

DECLARE @BookNameValue NVARCHAR(128)
DECLARE @SQL_QUERY NVARCHAR (MAX)
DECLARE @PARAMS NVARCHAR (1000)
SET @BookNameValue = 'Book6'SET @PARAMS = '@BookName NVARCHAR(128)'
SET @SQL_QUERY =N'SELECT id, name, price FROM Books WHERE name = @BookName'EXECUTE sp_executesql @SQL_QUERY ,@PARAMS, @BookName = @BookNameValue

In the above script, the value entered by the user is stored in the @BookNameValue variable.

在上面的脚本中，用户输入的值存储在@BookNameValue变量中。

Next, in the @SQL_QUERY string, the @BookName parameter is used to search the book. The @PARAMS variable defines the list of parameters. In this case, we only have one parameter i.e. @BookName. Finally, while executing the query via sp_executesql stored procedure, the @SQL_QUERY, the @PARAMS variable, and the value for the @BookName parameter are passed at runtime, in the output you will see the record of the book named “Book6”.

接下来，在@SQL_QUERY字符串中，使用@BookName参数搜索书籍。 @PARAMS变量定义参数列表。 在这种情况下，我们只有一个参数，即@BookName。 最后，在通过sp_executesql存储过程执行查询时，在运行时传递@ SQL_QUERY，@ PARAMS变量和@BookName参数的值，在输出中，您将看到名为“ Book6”的书的记录。

Let’s now try to execute a SQL injection on this parameterized query. We will append “OR 1 = 1 ” at the end of the @BookNameValue variable to see if we can retrieve all the records from the Books table:

现在，让我们尝试对该参数化查询执行SQL注入。 我们将在@BookNameValue变量的末尾附加“ OR 1 = 1”，以查看是否可以从Books表中检索所有记录：

DECLARE @BookNameValue NVARCHAR(128)
DECLARE @SQL_QUERY NVARCHAR (MAX)
DECLARE @PARAMS NVARCHAR (1000)
SET @BookNameValue = 'Book6 OR 1 = 1'SET @PARAMS = '@BookName NVARCHAR(128)'
SET @SQL_QUERY =N'SELECT id, name, price FROM Books WHERE name = @BookName'EXECUTE sp_executesql @SQL_QUERY ,@PARAMS, @BookName = @BookNameValue

If you execute the above query, you will see that no records will be returned.

如果执行上面的查询，您将看到将不返回任何记录。

This is because in the @PARAMS variable we defined that the type of @BookName should be NVARCHAR, therefore the sp_executesql stored procedure expects a single string value for the @BookName parameter, without any OR/AND conditions, etc. Thus, SQL injection is prevented.

这是因为在@PARAMS变量中，我们定义了@BookName的类型应为NVARCHAR，因此sp_executesql存储过程期望@BookName参数具有单个字符串值，而没有任何OR / AND条件，等等。因此，SQL注入是预防。

结论 (Conclusion)

SQL injection attack is one of the most commonly exploited hacking techniques to access private database records. This article explains how SQL injection attack works and how you can use parameterized SQL queries to avoid SQL injection attacks.

SQL注入攻击是访问私有数据库记录的最常用的黑客技术之一。 本文介绍了SQL注入攻击的工作原理，以及如何使用参数化SQL查询来避免SQL注入攻击。

翻译自: https://www.sqlshack.com/sql-injection-introduction-and-prevention-methods-in-sql-server/

sql server注入