将数据格式化为数据库:防止SQL注入

Question

最近有人提到我们通过表单提交将数据插入我们的SQL数据库的方法受到SQL注入攻击,并且需要一些建议来加强我们的安全性.

这是将表单数据插入数据库的代码:

        <cfquery name="InsRegistrant" datasource="#application.Datasource#" dbtype="odbc">

            INSERT INTO Schedule_Registrations(
                schedule_id,
                first_name,
                last_name,
                phone_number,
                email,
                guest,
                list_type,
                datetime_registered
             )
            VALUES(
                #url.schedule_id#,
                '#FORM.first_name#',
                '#FORM.last_name#',
                '#CleanPhoneNumber#',
                '#FORM.email#',
                 #attendee.guest#,
                 <!--- Values for list types 
                    0 = NEVER USE Will cause many many problems
                    1 = Main List
                    2 = Waiting List --->                    
                 #attendee.list_type#,
                 #createodbcdatetime(now())#
             )                
        </cfquery>

CleanPhoneNumber以这种方式设置:

<cfset CleanPhoneNumber = REReplace(form.phone_number, "[^0-9]", "", "ALL") />

我被告知要使用,例如,

<cfqueryparam cfsqltype="cf_sql_varchar" value="#form.phone_number#" />

但我不确定要更换什么以及在哪里.当我用这样的值替换值时,我得到一个错误.

任何方向都会有所帮助..

Answer 1

你应该将所有表单和url变量包装在中 cfqueryparam

您的查询将如下所示:

<cfquery name="InsRegistrant" datasource="#application.Datasource#" dbtype="odbc">
    INSERT INTO Schedule_Registrations(
         schedule_id,
         first_name,
         last_name,
         phone_number,
         email,
         guest,
         list_type,
         datetime_registered
     )
     VALUES(
         <cfqueryparam cfsqltype="cf_sql_integer" value="#url.schedule_id#">,
         <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.first_name#">,
         <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.last_name#">,
         <cfqueryparam cfsqltype="cf_sql_varchar" value="#CleanPhoneNumber#">,
         <cfqueryparam cfsqltype="cf_sql_varchar" value="#FORM.email#">,
         <cfqueryparam cfsqltype="cf_sql_integer" value="#attendee.guest#">,
         <!--- Values for list types 
            0 = NEVER USE Will cause many many problems
            1 = Main List
            2 = Waiting List --->                    
         <cfqueryparam cfsqltype="cf_sql_integer" value="#attendee.list_type#">,
         #createodbcdatetime(now())#
     )                
</cfquery>

我不确定所有数据类型是否正确,请参阅所有数据类型的完整文档cfqueryparam.