Á˽âÊý¾Ý´æ´¢mysql¶Ô²âÊÔµÄÖúÒæ
¹ýÈ¥µÄÒ»¸öÔ£¬ÎҵŤ×÷ÖØÐͼÔںϷþÄ£¿éµÄ²âÊÔ¡£ÆÄÓÐһЩÊÕ»ñ¡£
´Ë´Î´óÁ¿ºÍmysql´ò½»µÀ£¬¶Ô²úÆ·µÄÊý¾Ý´æ´¢ÓÐÁ˱ȽÏÈ«ÃæµÄÕÆÎÕ¡£²¢´ÙʹºÍÖ´ÐÐÁËdbµÄ±í½á¹¹ºÍÊôÐԵļì²é¡£ºÏ·þͶ·Åºó£¬ÔÝδ·¢ÏÖÒò´íÎóÊý¾Ýµ¼ÖµÄbug»òʹʡ£
²¢ÔÚ²âÊÔ³õÆÚ¾Í¹Ø×¢ºÍ¼ì²âÐÔÄÜÖ¸±ê£¬´Ùʹ³ÌÐò×öÁËÒ»´ÎÐÔÄܲâÊÔ£»¶ÔͶ·ÅʱµÄ·çÏÕÔöÇ¿ÁËÔ¤·ÀºÍ¿ØÖÆ¡£
ÕâЩ¶ÔÎҵIJâÊÔ˼ά£¬ÓÐÁ˺ܴóµÄÍØÕ¹¡£
Ïà¹ØÎĵµ£º
MYSQL4.1¼°¸ü¸ß°æ±¾Ö§³Ö·þÎñÆ÷¶Ë×¼±¸Óï¾ä(Prepared Statements), ËüʹÓÃÔöÇ¿µÄ¶þ½øÖƿͻ§¶Ë/·þÎñÆ÷ÐÒéÔÚ¿Í»§¶ËºÍ·þÎñÆ÷Ö®¼ä¸ßЧµÄ·¢ËÍÊý¾Ý£¬¿ÉÒÔͨ¹ýÖ§³ÖÕâÖÖÐÐÐÒéµÄ±à³Ì¿âÀ´·ÃÎÊ×¼±¸Óï¾ä£¬ÁÐÈëMYSQL CAPI,MYSQL Connector/JºÍMYSQL Connector/NET ΪJAVAºÍ.NETÌṩÁËͬÑùµÄ·ÃÎʽӿڡ£ËüÒ²ÓÐSQLÓïÑԵķÃÎʽӿڡ£
´´½¨×¼ ......
¸ù¾ÝÄãµÄʹÓÃÄ¿µÄÎÒ¾õµÃÕâ¸öº¯ÊýÓÐÁ½·½ÃæµÄÓÃ;£º
·ÀÖ¹SQL Injection¹¥»÷£¬Ò²¾ÍÊÇÄã±ØÐëÑéÖ¤Óû§µÄÊäÈë
²Ù×÷Êý¾ÝµÄʱºò±ÜÃâ²»±ØÒªµÄ×Ö·ûµ¼Ö´íÎó
mysql_real_escape_string() º¯ÊýתÒå SQL Óï¾äÖÐʹÓõÄ×Ö·û´®ÖеÄÌØÊâ×Ö·û¡£
ÏÂÁÐ×Ö·ûÊÜÓ°Ï죺
\x00
\n
\r
\
'
"
\x1a
Èç¹û³É¹¦£¬Ôò¸Ãº¯Êý·µ»Ø±»×ªÒåµÄ×Ö·û´ ......
±ÈÈ磺
insert into User values(x1,x2,x3,x4),(x1,x2,x3,x4),(x1,x2,x3,x4)
ÕâÖÖд·¨£¬ÁÐÊýÁ¿±ØÐëºÍ±íÖÐËùÓÐÁб£³ÖÒ»Ö£¬Ò²¾ÍÊÇ˵Áж¼ÒªÁгöÀ´¡£
Õâ¸öuser±íÀïÃæµÄÒ»¸ö×Ö¶Îx1ÊǸö×ÔÔö³¤×ֶΣ¬ÔòÓ¦¸ÃÌînullռλ
insert into User values(null,x2,x3,x4),(null,x2,x3,x4),(null,x2,x3,x4)
·ñÔò»á±¨´í¡£ ......
mysql ±àÒë°²×°Óë±àÒë²ÎÊý
Ìí¼Ómysql×éºÍmysqlÓû§
[root@centos mysql]# groupadd mysql
[root@centos mysql]# useradd -g mysql mysql
±àÒëÓë°²×°
tar -zxvf mysql-5.1.35.tar.gz
./configure \
--prefix=/usr/local/mysql \
--localstatedir=/data/mysql/data \ m ......
¡¾×ª¡¿http://www.linuxsir.org/main/?q=node/241
1.°²×°»·¾³
²Ù×÷ϵͳ£ºRed Hat Linux Enterprise AS 4.0
Êý¾Ý¿â£ºMySQL 5.0.24
Web·þÎñÆ÷£ºApache 2.2.3
½Å±¾ÓïÑÔ£ºPHP 5.1.6
2.°²×°MySQL 5.0.24
-------------ÏÂÔØÈí¼þ°ümysql-5.0.24.tar.gz£¬µØÖ·http://www.mysql.com-------------
# tar zvxf mysql-5.0.24.ta ......