SQL 注入防漏洞攻击

登陆.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;

namespace Sql注入漏洞攻击
{
    public partial class 登陆 : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {

        }

        protected void Button1_Click(object sender, EventArgs e)
        {
            string constr = "data source=.;initial catalog=UserDB1;User id=sa;password=842674";
            using (SqlConnection con = new SqlConnection(constr))
            {
                //string sql = string.Format("select count(*) from T_Users where FuserName='{0}'and Fpassword='{1}'",txtUsername.Text.Trim(),txtPassword.Text.Trim());
                //以上这种拼接sql语句的方法又注入漏洞攻击的问题 jk' or 1=1--
                //如果避免注入漏洞攻击呢?使用参数的方法或存储过程的方法

                string sql = "select count(*) from T_Users where FuserName=@username and Fpassword=@password";

                using (SqlCommand cmd = new SqlCommand(sql, con))
                {
                    con.Open();
                    //在数据服务端执行sql语句前需要告诉它@username, @password是谁
                    //cmd.Parameters.AddWithValue("@username",txtUsername.Text.Trim());
                    //cmd.Parameters.AddWithValue("@password",txtPassword.Text.Trim());

                    //每一个参数都是一个参数对象

                    //SqlParameter p1 = new SqlParameter("@username",txtUsername.Text.Trim());
                    //cmd.Parameters.Add(p1);

                    //SqlParameter p2 = new SqlParameter("@password", txtPassword.Text.Trim());
                    //cmd.Parameters.Add(p2);

                    //很多情况下参数的个数很多p1.......p9

                    SqlParameter[] pms = new SqlParameter[]{
                        new SqlParameter("@username",txtUsername.Text.Trim()),
                        new SqlParameter("@password",txtPassword.Text)
                       
                    };
                    cmd.Parameters.AddRange(pms);

                    //通过监视发现，ADO的参数替换的方法避免了注入漏洞攻击，它通过一个存储过程实现了把输入的任何字符串作为字串处理的形式。
                    //exec sp_executesql N'select count(*) from T_Users where FuserName=@username and Fpassword=@password',N'@username nvarchar(13),@password nvarchar(4)',@username=N'jk'' or 1=1 --',@password=N'sfds'
                    //在sql中，把’单引号转意为字符串的方法是前面再加一个单引号。
                    //在sql中的参数都是@开始的，

                    int r=Convert.ToInt32(cmd.ExecuteScalar());//把sql语句送到数据服务端执行
                    con.Close();//可以提前关闭连接，提高效率
                    if (r > 0)
                    {
                        Response.Write("登陆成功");
                    }
                    else
                    {
                        Response.Write("登陆失败");
                    }
                }
            }

        }
    }
}