조치사항
[패턴문자]
' union
" select
insert
# drop
( update
) from
; where
@ join
= substr (oracle)
* user_tables (oracle)
/ user_table_columns (oracle)
+ subsring (ms-sql)
information_schema (mysql) sysobjects (ms-sql)
table_schema (mysql) declare (ms-sql)
/* */
&& openrowset
xp_ or
and %

- 패턴 문자 필터링
- 언어별 디버깅 모드시 상세한 에러출력 금지(사용자 정의 에러 사용 권장)

JSP SQL Injection 시큐어 코딩


page.jsp 파일에서
String param = request.getParameter('field');

Pattern PreventChar = Pattern.compile("['\"\\-#()@;=*/+]");
String filteredData = PreventChar.matcher(param).replaceAll("");

OR

String[] PreventChars = {"'","\""...} //위 표에 있는 데이터 나열함.

for (int i=0; i< PreventChars.length; i++) {
if(param.indexOf(PreventChars[i]) != -1){
System.out.println("금지된 키워드 사용입니다.");
return false;
}
}

db.jsp 파일에서
PreparedStatement stmt = conn.prepareStatement("select * from table where field1=? and field2=?");
stmt.setString(1, value1);
stmt.setString(2, value2);
 
ResultSet rs = stmt.executeQuery();


PHP SQL Injection 시큐어 코딩


page.php파일에서
$param = $_POST['field'] or $_GET['field'];

$filtereddata = htmlspecialchars($param);
$filtereddata = strip_tags($filtereddata);
$filtereddata = mysql_real_escape_string($filtereddata);

OR

$PreventChars = array("'","\""...); //위 표에 있는 데이터 나열함.

foreach($PreventChars as $keyword){
$param = str_replace($keyword,"",$param);
}


db.php파일에서
$value =$filtereddata;
$sth = $dbh->prepare('select field1, field2...from table where field1 = :field1');
$sth->bindValue(':field1',$value,PDO:PARAM:STR,10);
$sth->execute();



ASP.NET (C#) 시큐어 코딩(MSDN 참조)


page.aspx 중에서
<%@ language="C#" %>
<form id="form1" runat="server">
    <asp:TextBox ID="SSN" runat="server"/>
    <asp:RegularExpressionValidator ID="regexpSSN" runat="server"        
                                    ErrorMessage="Incorrect SSN Number"
                                    ControlToValidate="SSN"        
                                    ValidationExpression="^\d{3}-\d{2}-\d{4}$" />
</form>

page.apsx.cs 중에서
if (Regex.IsMatch(Request.Cookies["SSN"], "^\d{3}-\d{2}-\d{4}$"))
{
    // access the database
}
else
{
    // handle the bad input
}

using System;
using System.Text.RegularExpressions;

public void CreateNewUserAccount(string name, string password)
{
    // Check name contains only lower case or upper case letters,
    // the apostrophe, a dot, or white space. Also check it is
    // between 1 and 40 characters long
    if ( !Regex.IsMatch(userIDTxt.Text, @"^[a-zA-Z'./s]{1,40}$"))
      throw new FormatException("Invalid name format");

    // Check password contains at least one digit, one lower case
    // letter, one uppercase letter, and is between 8 and 10
    // characters long
    if ( !Regex.IsMatch(passwordTxt.Text,
                      @"^(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,10}$" ))
      throw new FormatException("Invalid password format");

    // Perform data access logic (using type safe parameters)
    ...
}
db.cs 파일에서
using System.Data;
using System.Data.SqlClient;

using (SqlConnection connection = new SqlConnection(connectionString))
{
DataSet userDataset = new DataSet();
SqlDataAdapter myCommand = new SqlDataAdapter(
"LoginStoredProcedure", connection);
myCommand.SelectCommand.CommandType = CommandType.StoredProcedure;
myCommand.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11);
myCommand.SelectCommand.Parameters["@au_id"].Value = SSN.Text;

myCommand.Fill(userDataset);
}

[참고사이트]

https://msdn.microsoft.com/en-us/library/ff648339.aspx