数据库开发 - SQL注入与防范单元做业

#题目 1（100分） 有一张学生表

如今须要根据学生名称获取学生的期末考试分数。

public static void getStudent(String name) throws ClassNotFoundException {
    Connection conn = null;
    Statement stmt = null;
    ResultSet rs = null;
    try {
      Class.forName(JDBC_DRIVER);
      conn = DriverManager.getConnection(DB_URL, USER, PASS);
      stmt = conn.createStatement();
      rs = stmt.executeQuery("select name,score from student where name =' " + name +"'");
      while (rs.next()) {
        System.out.println(rs.getString("name") + ":" + rs.getInt("score"));
      }
    } catch (SQLException e) {
      // ignore
    } finally {
      if (rs != null) {
        try {
          rs.close();
        } catch (Exception e) {
          // ignore
        }
      }
      if (stmt != null) {
        try {
          stmt.close();
        } catch (Exception e) {
          // ignore
        }
      }
      if (conn != null) {
        try {
          conn.close();
        } catch (SQLException e) {
          // ignore
        }
      }
    }
  }

1. 请指出上面这段程序存在什么安全风险？并给出具体的测试用例。
2. 请从新编写应用程序，解决上述风险。

##初始化SQL

CREATE TABLE `student` (
`Id`  int NOT NULL AUTO_INCREMENT ,
`name`  varchar(100) NULL ,
`score`  int NULL ,
PRIMARY KEY (`Id`)
)
;


INSERT INTO `student` (`Id`, `name`, `score`) VALUES ('1', 'Xiaoming', '100');
INSERT INTO `student` (`Id`, `name`, `score`) VALUES ('2', 'XiaoLi', '101');
INSERT INTO `student` (`Id`, `name`, `score`) VALUES ('3', 'XiaoZhao', '102');

##解答

1. 请指出上面这段程序存在什么安全风险？并给出具体的测试用例。
   回答： 1.这段代码有代码注入的安全风险。很是容易让黑客对数据库进行遍历。
   测试用例：

public void testGetStudentBug() throws Exception {
        StudentDAO.getStudent("XiaoMing\' OR 1=1; -- ");
    }

运行结果

[SQL]:select name,score from student where name ='XiaoMing' OR 1=1; -- '
Xiaoming:100
XiaoLi:101
XiaoZhao:102

2.如下是从新编写的代码，进行风险规避

public static void getStudentSafe(String name) throws ClassNotFoundException {
        Connection conn = null;
        PreparedStatement preparedStatement = null;
        ResultSet rs = null;
        try {
            Class.forName(JDBC_DRIVER);
            conn = DriverManager.getConnection(DB_URL, USER, PASS);

            String sql = "SELECT name,score FROM student WHERE name = ?";

            System.out.println("SQL:" + sql);

            preparedStatement = conn.prepareStatement(sql);
            preparedStatement.setString(1,name);
            rs = preparedStatement.executeQuery();

            while (rs.next()) {
                System.out.println(rs.getString("name") + ":" + rs.getInt("score"));
            }
        } catch (SQLException e) {
            // ignore
            System.out.println("[SQLException]:" + e.toString());
        } finally {
            if (rs != null) {
                try {
                    rs.close();
                } catch (Exception e) {
                    // ignore
                }
            }
            if (preparedStatement != null) {
                try {
                    preparedStatement.close();
                } catch (Exception e) {
                    // ignore
                }
            }
            if (conn != null) {
                try {
                    conn.close();
                } catch (SQLException e) {
                    // ignore
                }
            }
        }
    }

测试代码

public void testGetStudentSafe1() throws Exception {
        StudentDAO.getStudentSafe("XiaoMing");
    }

    public void testGetStudentSafe() throws Exception {
        StudentDAO.getStudentSafe("XiaoMing\' OR 1=1; -- ");
    }

错误的执行结果

SQL:SELECT name,score FROM student WHERE name = ?

Process finished with exit code 0