第十五章 sql中的安全问题

╰半橙微兮° 2023-07-11 06:07 3阅读 0赞

**sql注入 ：**

**![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70][]**

**逻辑注入 及 注释符 注入 示例**

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 1][]

### 转自：[https://www.cnblogs.com/mydesky2012/p/11663882.html][https_www.cnblogs.com_mydesky2012_p_11663882.html] ###

开始

### 1 \# 与 $ 的区别 ###

mybatis中使用ParameterType向sql语句传参，在sql语句中引用这些参数的时候，有两种方式：\#parameterName, $parameterName。

两者的区别：使用\#parameterName方式引用参数的时候，Mybatis会把传入的参数当成是一个字符串，自动添加双引号。$parameterName引用参数时，不做任何处理，直接将值拼接在sql语句中。

\#是一个占位符，$是拼接符。

### 2 如何防止sql注入 ###

使用 \# 能够防止sql注入，$不能避免注入攻击。

\#的方式引用参数，mybatis会先对sql语句进行预编译，然后再引用值，能够有效防止sql注入，提高安全性。$的方式引用参数，sql语句不进行预编译。

结束

转自：[https://www.cnblogs.com/mydesky2012/p/11663882.html][https_www.cnblogs.com_mydesky2012_p_11663882.html]

**预防注入 **

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 2][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 4][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 5][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200304143432570.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200304143642608.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70
[https_www.cnblogs.com_mydesky2012_p_11663882.html]: https://www.cnblogs.com/mydesky2012/p/11663882.html
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200304144115690.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200304144421934.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200304144524707.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200304144820730.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2Jvc3Nfd2F5,size_16,color_FFFFFF,t_70