当前位置: 首页 > Web前端 > HTML5

NodeJSmysql需要注意sql注入_0

时间:2023-04-06 00:18:03 HTML5

鏈枃浠嬬粛鐐硅禐+鍏虫敞+鏀惰棌=瀛︿範浜嗐€傝櫧鐒舵垜浠笉浼氱洿鎺ヤ娇鐢ㄥ師鐢熺殑NodeJS鏂瑰紡鏉ュ紑鍙戝悗鍙帮紝浣嗘槸浜嗚ВSQL娉ㄥ叆杩樻槸寰堟湁蹇呰鐨勩€傛湰鏂囦娇鐢∟odeJS+MySQL鏉ヨ瑙QL娉ㄥ叆銆係QL娉ㄥ叆鏀诲嚮鏄竴绉嶉潪甯稿彜鑰佺殑鏀诲嚮鏂瑰紡锛屼粠web2.0璇炵敓寮€濮嬪氨鏈塖QL娉ㄥ叆鏀诲嚮銆傞€氬父鍑虹幇鍦ㄨ緭鍏ユ銆佹枃鏈绛夊墠绔粍浠朵腑銆傚湪杈撳叆鍐呭涓姞鍏QL璇彞锛屼竴璧蜂紶缁欏悗鍙般€傚悗鍙颁竴涓嶅皬蹇冿紝灏变細鎶婂墠绔紶杩囨潵鐨凷QL璇彞鎷兼帴鎴愯嚜宸辩殑SQL璇彞锛屾渶鍚庢嫾鎺ユ垚涓€娈垫敾鍑讳唬鐮併€傛墍浠ヤ竴瀹氳鏈洦缁哥吉锛屽惁鍒欏彲鑳戒細鍑虹幇鏁版嵁娉勯湶锛岀敋鑷虫湁琚垹搴撶殑鍙兘銆係QL娉ㄥ叆婕旂ず浠ョ櫥褰曚负渚嬨€傛垜鍦∕ySQL涓坊鍔犱簡涓€寮爑sers琛紝閲岄潰瀛樻斁鐨勬槸鐢ㄦ埛鍚嶅拰瀵嗙爜銆傚湪users琛ㄤ腑锛屾垜鏂板缓浜嗕竴鏉℃暟鎹細insertintousers(username,password,realname)values('leihou','123','Leihou');鏁版嵁鐨勫惈涔夋槸锛歶sername:'leihou'password:'123'realname:'杩呴浄鐚?姝ゆ椂鎴戝湪NodeJS鍚庡彴鍒涘缓浜嗕竴涓櫥褰曟柟娉昪onstmysql=require('mysql')//鍒涘缓涓€涓猚onnectionobjectconstcon=mysql.createConnection({host:'localhost',//鍦板潃user:'root',//杩炴帴鏁版嵁搴撶殑鐢ㄦ埛瀵嗙爜锛?123456',//杩炴帴鏁版嵁搴撶鍙g殑瀵嗙爜锛?3306',//榛樿绔彛database:'testdb'//鏁版嵁搴撳悕})//寮€濮嬭繛鎺on.connect()//鎵цsql鍑芥暟functionexec(sql){constpromise=newPromise((resolve,reject)=>{con.query(sql,(err,result)=>{if(err){reject(err)return}resolve(result)})})returnpromise}//鐧诲綍鏂规硶constlogin=(username,password)=>{constsql=`selectusername,realnamefromuserswhereusername='${username}'andpassword='${password}';`console.log(sql)returnexec(sql).then(rows=>{returnrows[0]||{}})}浠ヤ笂灏辨槸鐧诲綍鏂规硶銆傛渶鍚庯紝鍙互閫氳繃銆奛odeJS http璇锋眰銆嬩腑鎻愬埌鐨勬柟娉曚负鍓嶇鍒涘缓涓€涓帴鍙c€傜敱浜庣晫闈㈤儴鍒嗕笉鏄湰鏂囩殑閲嶇偣锛岃繖閲屾墦绠楃暐杩囷紙鍋锋噿锛夈€傝繖鏃跺€欏啀鍒涘缓涓€涓狧TML椤甸潰锛屽ぇ鑷寸敓鎴愬唴瀹癸紝鐒跺悗鐢ˋjax杩炴帴鍚庡彴銆傚伔鎳掔殑璇濆彲浠ョ洿鎺ョ敤postman娴嬭瘯銆傛寜鐓т笂闈㈢殑鐧诲綍鏂瑰紡锛屽湪鍓嶇杈撳叆濡備笅鍐呭灏卞彲浠ョ煡閬撳彲浠ョ櫥褰曟垚鍔熶簡銆?鍓嶅悗鏈夌┖鏍笺€傚瘑鐮佸彲浠ラ殢鎰忚緭鍏ャ€傛渶鍚庢嫾鎺ョ殑SQL璇彞鏄痵electusername,realnamefromuserswhereusername='leihou'--'andpassword='aslkfjsaf';娉ㄦ剰鎴戞槸闅忎究杈撳叆鐨勫瘑鐮併€傚湪MySQL涓紝--浠h〃娉ㄩ噴銆傛墍浠ヤ笂闈㈢殑璇彞灏卞彉鎴愪簡鏌ヨ鐢ㄦ埛鍚嶄负leihou鐨勬暟鎹€傚瘑鐮佽嚜鐒剁粫杩囦簡銆備笂闈㈣緭鍏ョ殑鐢ㄦ埛鍚嶅唴瀹圭粫杩囦簡鐧诲綍锛屾硠闇蹭簡淇℃伅銆備絾鏄鏋滃埆浜鸿鍒犻櫎浣犵殑琛紝鍚庢灉灏卞緢涓ラ噸浜嗐€備緥濡傚湪鐢ㄦ埛鍚嶈緭鍏ユ涓緭鍏ワ細leihou'锛涗粠鐢ㄦ埛涓垹闄わ紱-銆傚彧闇€鍒犻櫎鐢ㄦ埛琛ㄣ€傞槻姝QL娉ㄥ叆鏀诲嚮鐨勬柟娉曞お鑰佷簡锛屾湁鍗佸嚑骞寸殑鍘嗗彶浜嗐€傛墍浠ュ熀鏈殑搴斿鏂规硶宸茬粡鎴愮啛銆傛瘮濡傚鍓嶇浼犳潵鐨勫瓧绗︿覆杩涜杞爜銆備娇鐢∟odeJS涓嬭浇鐨凪ySQL渚濊禆鍖呬腑鎻愪緵浜嗚鏂规硶锛歟scape銆?/鐪佺暐閮ㄥ垎浠g爜constmysql=require('mysql')//鐪佺暐杩炴帴瀵硅薄鐨勫垱寤?/鐪佺暐杩炴帴鐨勫紑濮?/缁熶竴鎵цsql鍑芥暟constescape=mysql.escapeconstlogin=(username,password)=>{username=escape(username)password=escape(password)constsql=`selectusername,realnamefromuserswhereusername=${username}andpassword=${password};`console.log(sql)杩斿洖exec(sql)銆倀hen(rows=>{returnrows[0]||{}})}escape鏂规硶杩囨护鍚庣殑瀛楃涓蹭細琚浆涔夈€傛鏃跺鏋滆緭鍏ョ敤鎴峰悕leihou'--锛屽悗鍙版帶鍒跺彴浼氭墦鍗板涓嬪唴瀹癸細selectusername,realnamefromuserswhereusername='leihou\'--'andpassword='123345';鍙互鐪嬪埌leihou'鍚庨潰鐨勫崟寮曞彿琚浆涔変簡銆備互涓婂氨鏄疢ySQL濡備綍闃叉SQL娉ㄥ叆鏀诲嚮銆傛帹鑽愰槄璇火煈嶃€奛odeJS http璇锋眰銆嬸煈嶃€奛odeJS 5鍒嗛挓 杩炴帴MySQL 澧炲垹鏀规煡銆嬸煈嶃€奛odeJS Stream鍏ラ棬銆嬸煈嶃€奛odeJS 鎿嶄綔cookie銆嬸煈嶃€奛odeJS 5鍒嗛挓 杩炴帴 Redis 璇诲啓鎿嶄綔銆嬸煈嶃€奛odeJS 璇诲啓鏂囦欢銆嬬偣璧?鍏虫敞+鏀惰棌=瀛︿範浜?/p>