成人在线亚洲_国产日韩视频一区二区三区_久久久国产精品_99国内精品久久久久久久

您的位置：首頁(yè)技術(shù)文章
文章詳情頁(yè)

安全性測(cè)試 - nodejs中如何防m(xù)ySQL注入

瀏覽：112日期：2022-06-16 18:05:40

問(wèn)題描述

如題，如能有具體示例或demo鏈接感激不盡

問(wèn)題解答

回答1：使用escape()對(duì)傳入?yún)?shù)進(jìn)行編碼

var userId = 1, name = ’test’;var query = connection.query(’SELECT * FROM users WHERE id = ’ + connection.escape(userId) + ’, name = ’ + connection.escape(name), function(err, results) { // ...});console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = ’test’使用connection.query()的查詢(xún)參數(shù)占位符

var userId = 1, name = ’test’;var query = connection.query(’SELECT * FROM users WHERE id = ?, name = ?’, [userId, name], function(err, results) { // ...});console.log(query.sql); // SELECT * FROM users WHERE id = 1, name = ’test’使用escapeId()編碼SQL查詢(xún)標(biāo)識(shí)符

var sorter = ’date’;var sql = ’SELECT * FROM posts ORDER BY ’ + connection.escapeId(sorter);connection.query(sql, function(err, results) { // ...});使用mysql.format()轉(zhuǎn)義參數(shù)

var userId = 1;var sql = 'SELECT * FROM ?? WHERE ?? = ?';var inserts = [’users’, ’id’, userId];sql = mysql.format(sql, inserts); // SELECT * FROM users WHERE id = 1

Ref: http://www.dengzhr.com/node-j...

PS: Google第一頁(yè)就是答案

相關(guān)文章：