magic-api icon indicating copy to clipboard operation
magic-api copied to clipboard

Published 20 hours ago • verified publisher icon ssssssss-team

sql注入攻击？

Open lincoln310 opened this issue 3 years ago • 2 comments

请问，能防止sql注入攻击吗？

lincoln310 avatar Jan 20 '22 07:01 lincoln310

只要sql中使用#{}的参数都不会有注入风险，使用${}的或者拼接字符串的才有可能注入。具体的要看你自己。

javamxd avatar Jan 23 '22 03:01 javamxd

防止sql注入攻击，就是要防止各类方式啊。#{}称之为合法规则，但是需要防止违法使用啊。

javamxd @.***> 于2022年1月23日周日 11:53写道：

只要sql中使用#{}的参数都不会有注入风险，使用${}的或者拼接字符串的才有可能注入。具体的要看你自己。

— Reply to this email directly, view it on GitHub https://github.com/ssssssss-team/magic-api/issues/39#issuecomment-1019408737, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABV6OAXQLTVIS6DU7AMLYX3UXN3STANCNFSM5ML6TBUA . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you authored the thread.Message ID: @.***>

lincoln310 avatar Aug 10 '22 01:08 lincoln310