個人對SQL預(yù)編譯的認(rèn)識:

1、效率提升,對SQL語句編譯一次可多次使用.避免了硬解析和軟解析等步驟，當(dāng)執(zhí)行的語句上規(guī)模的時候性能差異還是很明顯的。
2、安全提升,預(yù)編譯之后的SQL語句,語義不會發(fā)生變化,安全性有相當(dāng)大的提升。

?

using System; using System.Collections.Generic; using System.Linq; using System.Text; using System.Data.SqlClient; using System.Data;namespace PreSql {class Program{/** create table test_table ( a nvarchar(20) )insert into test_table(a) values('2');*/const string conStr = @"Password=1qaz!QAZ;Persist Security Info=True;User ID=sa;Initial Catalog=IBatisNet;Data Source=WANGN\CR";static void Main(string[] args){Console.WriteLine("SqlJoin:");SqlJoin();Console.WriteLine();Console.WriteLine("PreSqlTest");PreSqlTest();Console.WriteLine("Completed");Console.Read();}static void SqlJoin(){string sql = "select count(*) from test_table where a='{0}'";string tmpSql = string.Format(sql, "1' or '1'='1");string tmpSql2 = string.Format(sql, "1");using (SqlConnection conn = new SqlConnection(conStr)){if (conn.State != ConnectionState.Open){conn.Open();}SqlCommand com = new SqlCommand(tmpSql, conn);object obj = com.ExecuteScalar();Console.WriteLine("SQL注入成功:" + obj.ToString());SqlCommand com2 = new SqlCommand(tmpSql2, conn);object obj2 = com2.ExecuteNonQuery();Console.WriteLine("正常應(yīng)返回-1:" + obj2);}}static void PreSqlTest(){string sql = "select count(*) from test_table where a=@id";using (SqlConnection conn = new SqlConnection(conStr)){if (conn.State != ConnectionState.Open){conn.Open();}SqlCommand com = new SqlCommand(sql, conn);com.Parameters.Add(new SqlParameter{DbType = DbType.String,Size = 256,ParameterName = "@id",Value = "1 or 1=1"});object obj = com.ExecuteScalar();Console.WriteLine("SQL注入不成功:" + obj.ToString());SqlCommand com2 = new SqlCommand(sql, conn);com2.Parameters.Add(new SqlParameter{DbType = DbType.String,Size = 256,ParameterName = "@id",Value = "1"});object obj2 = com2.ExecuteNonQuery();Console.WriteLine("正常應(yīng)返回-1:" + obj2);}}} }

執(zhí)行結(jié)果:

SqlJoin:
SQL注入成功:1
正常應(yīng)返回-1:-1

PreSqlTest
SQL注入不成功:0
正常應(yīng)返回-1:-1
Completed

轉(zhuǎn)載于:https://www.cnblogs.com/wangn/p/4170755.html

創(chuàng)作挑戰(zhàn)賽新人創(chuàng)作獎勵來咯，堅(jiān)持創(chuàng)作打卡瓜分現(xiàn)金大獎

總結(jié)

以上是生活随笔為你收集整理的SQL预编译防注入小测试的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯，歡迎將生活随笔推薦給好友。