前几天帮一个客户写了一个C++连接MySQL,当他用到他的游戏中后,被人注射了,用了一个永真式,无限的刷了游戏装备
所以,我针对参数和整体SQL语句写了两个简单的函数,进行简单的过滤
bool CheckSQL(string sql) { string key[9] = { "%","/","union","|","&","^" ,"#","/*","*/"}; for (int i = 0; i < 9; i++) { if (sql.find(key[i]) != string::npos) { return false; } } return true; } bool CheckParameter(string Parameter) { string key[14] = {"and","*","="," ","%0a","%","/","union","|","&","^" ,"#","/*","*/" }; for (int i = 0; i < 14; i++) { if (Parameter.find(key[i]) != string::npos) { return false; } } return true; }
原文地址:https://www.cnblogs.com/lee-li/p/8669302.html
时间: 2024-10-13 21:23:47