SQL 安全性: 新型 SQL 截断攻击和防御方法

核心提示： CREATE PROCEDURE sp_setPassword@username varchar(25),@old varchar(25),@new varchar(25)AS-- Declare variables.DECLARE @command varchar(100)-- In t

CREATE PROCEDURE sp_setPassword
　　@username varchar(25),
　　@old varchar(25),
　　@new varchar(25)
AS
-- Declare variables.
DECLARE @command varchar(100)
-- In the following statement, we will need 43 characters
-- to set an administrator password without knowing its current password.
-- 100 - 26 - 16 - 15 = 43 (26 for update stmt, 16 for where clause,
-- 15 for ‘administrator’). But @new only takes 25 characters, which we
-- can get around by using single quotes. So one can pass the following
-- parametes and set admin password. @new = 18 single quotes, 1 Capital
-- letter, 1 symbol, 2 small case letters, 1 digit
-- @username = administrator
-- @command becomes
-- update Users set password=‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘‘!Abb1’
-- where username=‘administrator’
SET @command= ‘update Users set password=‘ + QUOTENAME(@new,’’’’) +
‘ where username=‘ + QUOTENAME(@username,’’’’) + ‘ AND password = ‘ + QUOTENAME(@old,’’’’)
-- Execute the command.
EXEC (@command)
GO