Uma usebenzisa i-stripchar ukuze uhlanze okokufaka komsebenzisi, awuwedwa. Abathuthukisi abaningi bathembele kulolu hlobo lwe ukufakwa kokuhlanza ukuvimba imizamo yokujova. Uma uqala ukubona, kubonakala kunengqondo, susa izinhlamvu eziyingozi, bese umthwalo unyamalala. Kodwa-ke, le ndlela inikeza umuzwa wokuvikeleka ongamanga. Eqinisweni, abahlaseli bangadlula izihlungi ezilula ezifana i-stripchar usebenzisa imithwalo yokukhokha efihliwe, ukufaka amakhodi, noma ukushintshashintsha komongo ngobuhlakani. Yingakho onjiniyela abahlakaniphile bengagcini lapho. Kunalokho, basebenzisa imibuzo yepharamitha, okuvimbela ukuhlaselwa ngomjovo empandeni.
Kulesi sihloko, uzofunda ukuthi kungani i-stripchar yehluleka ezimweni zangempela, indlela abahlaseli abasebenzisa kabi ngayo lezi zihlungi, nokuthi yiziphi ezinye izindlela eziphephile ezisebenza ngempela. Sizohamba ngezibonelo zekhodi, sibonise amasu avamile okudlula, futhi sichaze ukuthi kanjani ukufakwa kokuhlanza kumele kuhlale kuhlanganiswe nezivikelo zesakhiwo ezifana imibuzo yepharamitha, noma uzohlala usengozini.
Ini i-stripchar Empeleni Uyakwenza (futhi Akakwenzi)
Abathuthukisi abaningi basebenzisa stripchar noma imisebenzi efanayo yokususa izinhlamvu ezingaphephile kokufakwayo komsebenzisi. Ngokuvamile, isusa izimpawu zokubhala, izimpawu ezikhethekile, noma yini engekho ngezinombolo. Ekuqaleni, lokho kuzwakala sengathi ukufakwa kokuhlanza, kodwa akusona isivikelo sangempela.
Ake sikuchaze kahle. Umsebenzi onjengalona:
kususa izinhlamvu ezifana ', ", noma ;Ngakho-ke, uma ungena:
Kuba:
Ngisho noma okokufaka komsebenzisi kubukeka kuhlanzekile, abahlaseli bangakwazi ukufaka imithwalo ye-SQL besebenzisa i-logic yodwa, ikakhulukazi uma uhlelo lokusebenza lwakha imibuzo ngokuhlanganiswa kwezintambo. Ukuvimbela ngempela ukujova kwe-SQL, kumele usebenzise imibuzo ehlukaniswe ngamapharamitha kanye nokuphathwa kokufakwayo okuqaphela umongo. Izihlungi zezinhlamvu ezifana stripchar() akwanele nje.
Impela, okokufaka okuhlutshiwe kungabonakala kuphephile uma ubheka nje. Kodwa-ke, le ndlela ayishintshi indlela enengqondo enobungozi, ishintsha kuphela indlela ebhalwe ngayo. Eqinisweni, abahlaseli bavame ukusizakala ngalokhu ngokufaka ikhodi yemithwalo ekhokhelwayo, ukufaka isikhala esimhlophe, noma ukusebenzisa izinhlamvu ezisusiwe ngendlela efanele ukuze badlule isihlungi sakho ngokuphelele.
Ngaphandle kwalokho, i-stripchar ayinawo umongo obalulekile. Ayazi ukuthi okokufaka kuya kudathabheyisi, igobolondo, noma isiphequluli. Lokho kusho ukuthi ayikwazi ukusebenzisa i-escape noma ikhodi efanele. Ukuhlanza okokufaka ngaphandle kokwazi indawo okuyo kufana nokubalekela i-HTML kuyilapho usongo lwangempela luyi I-SQLi.
Ekupheleni, i-stripchar Ayichazi noma ayivikeli lutho, imane ihlela izintambo. Futhi ukuhlela akulona ukuphepha. Uma ufuna ukuvikelwa kwangempela, sebenzisa imibuzo ehlelekile, eqinisekisiwe, nenemingcele. Ukuphela kwesikhathi.
Ukuze wenze umehluko ucace, nansi indlela i-stripchar eqhathanisa ngayo eceleni nemibuzo ebekwe eceleni:
Imibuzo ye-Stripchar vs Parameterized: Yimuphi Ovikela Ikhodi Yakho Ngempela?
| Isici | stripchar() | Imibuzo Enemingcele |
|---|---|---|
| Ukuvikelwa Level | Ukuhlanzwa kwezintambo okuyisisekelo. Kungadlulwa kalula ngamaqhinga okubhala ikhodi noma okunengqondo. | Isivikelo esinamandla kuzo zonke izinhlobo zokujova kwe-SQL. |
| Ukuqwashisa Ngomongo | Ayiboni kahle umongo (i-SQL, i-HTML, igobolondo, njll.). Isebenzisa umthetho ofanayo yonke indawo. | Ukuqonda ngokugcwele umongo. Isebenzisa ukubaleka okufanele endaweni ngayinye. |
| Umzamo Wonjiniyela | Kulula ukuyisebenzisa kodwa ayithembekile ukusetshenziswa isikhathi eside. | Kudinga ukuhlanganiswa okufanele, kodwa okuqinile futhi okuqinisekisiwe esikhathini esizayo. |
| Ukumelana Nokudlula | Abahlaseli abaphansi — bavumelana kalula besebenzisa i-whitespace, ikhodi, noma i-logic. | Okuphezulu — kuhlukanisa ikhodi kudatha futhi kuvimbela ukujova ngokuthembekile. |
| Ukuqiniseka Kokuphepha | Umuzwa wokuphepha ongamanga — ungase ufihle inkinga ngaphandle kokuyilungisa. | Imboni ethembekile standard ukuze kwenziwe umbuzo ophephile. |
Indlela Abahlaseli Abadlula Ngayo Ukuhlanza Okungenayo
Lena indlela ukugeleza okuvamile okusengozini okubukeka ngayo lapho onjiniyela bethembela ku- i-stripchar ukuze kuhlanzwe izinto ezifakiwe:
Abahlaseli akudingeki baphule izihlungi zakho, badinga nje hamba nxazonke kuboUma onjiniyela bethembele ku- i-stripchar ukuze kuhlanzwe okokufaka, bavame ukucabanga ukuthi ukususa izinhlamvu ezifana nezingcaphuno noma ama-semicolon kuzovimba imizamo yokujova. Kodwa-ke, abahlaseli bajwayela ngokushesha. Bakha uhlaka lokufaka. imithwalo yokukhokha efihliwe ezidlula ezihlungini ezisekelwe ku-regex, ikakhulukazi lapho lezo zihlungi zingenawo umongo.
Isibonelo, ake sithi uzama ukuhlanza okokufaka kanje:
Ngisho noma umsebenzisi engakwazi ukuthumela i-classic ' OR 1=1 --, bangasebenzisa amaqhinga e-Unicode, ukuhlanganiswa kwezintambo, noma i-syntax ephukile esasebenza. Imithwalo enjengalena ivame ukusebenza:
noma:
Uma umsebenzi wakho ususa izinhlamvu ezingezona amagama, ungase yakha kabusha ngephutha umyalo we-SQL osebenzayoOkubi nakakhulu, abahlaseli bangabhala amanani ngezindlela ezidlula isihlungi sakho kodwa zihlukaniswe uhlelo oluqondiwe.
Ngaphandle kokufakwa kwe-SQL, i-stripchar iyahluleka nakwezinye izimo, njengemiyalo yegobolondo, izindlela zamafayela, noma ngisho nokusebenza kweJavaScript. Njengoba ingenalo ulwazi lokuthi okokufaka kuzosetshenziswa kuphi, ayikwazi ukusebenzisa i-escape noma i-valuation efanele.
Ngenxa yalokho, ukufakwa kokuhlanza nge i-stripchar Kulula ukukugwema. Ukuphepha kwangempela kuvela ku- izilawuli eziqaphela umongo, ikakhulukazi imibuzo yepharamitha ezivimbela ngokuphelele ukufakwa kwe-logic.
Kungani Kufanele Usebenzise Imibuzo Enezimo Ezilinganiselwe Esikhundleni Salokho
Uma ufuna ukuyeka ukuhlaselwa ngemijovo ngempela, udinga yeka ukwakha imibuzo ngezintambo. Kulapho imibuzo yepharamitha ngena. Ngokungafani i-stripchar, abazihlungi, bona ikhodi ehlukile kudatha ezingeni lenjini.
Ake siphinde sihlole umbuzo ophukile:
Lokhu kuyingozi ngoba okokufaka kufakwa ngqo ku-SQL. Ngisho noma ususa izinhlamvu, usakha intambo engasetshenziswa kabi. Esikhundleni salokho, sebenzisa umbuzo onamapharamitha njengalona:
Lapha, umshayeli wedatha uyazi ukuthi userInput idatha, ikhodi engasebenziIyaphunyuka ngokuzenzakalelayo futhi ivimbele ukujova, noma ngabe okokufaka kuqukethe izingcaphuno, ama-semicolon, noma imithwalo yokukhokha efakwe ikhodi ye-hex.
KuPython:
Ku-PHP nge-PDO:
Kuzo zonke lezi zibonelo, imibuzo yepharamitha vimbela ukujova ngaphandle kokudinga ukuqagela ukuthi yiziphi izinhlamvu ezingaba yingozi. Awudingi i-stripchar, udinga ukwakhiwa kwemibuzo ehlelekile, eqonda umongo.
Ngaphezu kwalokho, le ndlela ivimba imithwalo efihliwe, amaqhinga e-Unicode, kanye nama-bypasses okubhala ikhodi, amaphethini afanayo okugwema atholakala ku Ubuthakathaka be-XSSAmathuluzi afana ne-Xygeni athola lezi zinsongo kusenesikhathi SAST ukuhlaziywa.
Ngamafuphi, ukuzivikela kwangempela akunciki ezihlungini. Kuncika kumaphrothokholi, ama-API athembekile, kanye nomongo ogcwele. Uma usebenzisa amafreyimu noma i-dynamic service injection, qaphela ukuthi okokufaka kusakazeka kanjani nge-codebase yakho. Ukufakwa kokuthembela okuvikelekile kuqinisekisa ukuthi ngisho nokugeleza okuyinkimbinkimbi ngeke kuvule izindawo ezintsha zokuhlasela.
Ungathembeli ku i-stripcharSebenzisa i-Xygeni ukuze Uqinisekise Ukuzivikela Kwangempela
Noma ngabe usebenzisa imibuzo yepharamitha, akukho siqinisekiso sokuthi yonke i-codebase yakho izolandela okufanayo standard. I-logic yakudala, izikripthi zenkampani yangaphandle, noma imigqa enganakwa ku-PR isengaletha izingozi zokujova. Yilapho kanye i-Xygeni isiza khona.
I-Xygeni iskena ikhodi yakho yomthombo, pull requests, kanye ne-CI pipelineukubamba:
- Izintambo zombuzo ezakha i-SQL ngokuhlangana
- Izihlungi ezibuthakathaka noma ezikhulele ekhaya ezifana i-stripchar
- I-logic esolisayo ehambisana nemithwalo yokukhokha eyaziwayo efihliwe
Akudingeki ukuthi uhlole yonke imigqa. I-Xygeni imaka amaphethini angaphephile kusenesikhathi, iyasebenza Ukulungisa Okuzenzakalelayo lapho kungenzeka khona, futhi ingavimba ukuhlanganiswa okuyingozi ngokwenziwa ngezifiso Guardrails.
Kafushane, I-Xygeni iqinisekisa ukuthi imibuzo ebekwe kumapharamitha ayiyona nje indlela engcono kakhulu, kodwa iphoqelelwa ngezinga. Akusekho ukuqagela. Azikho izihlungi ezingabanjwanga. Ukuvikela kwangempela kuphela.f
Ufuna ukubona ukuthi i-Xygeni ithola kanjani imibuzo engavikelekile kukhodi yakho?
Izinto Ezibalulekile Okufanele Uzikhumbule Ngazo i-stripchar kanye Nezingozi Zokujova
- i-stripchar akuyona umsebenzi wokuphepha — kususa izinhlamvu, hhayi ingozi.
- Ukuhlanza okufakiwe akwanele uma wakha imibuzo ngokuhlanganiswa kwezintambo.
- Imibuzo ebekwe ngokwezimo iyindlela efanele yokuzivikela, futhi zonke izilimi noma uhlaka lwesimanje luyazisekela.
- Imithwalo efihliwe ingadlula izihlungi, ikakhulukazi uma kuhileleke amaqhinga okubhala ikhodi.
- Ukuhlaziywa okuqinile (SAST) amathuluzi abamba lokho abantu abakuphuthelwa, okuhlanganisa namaphethini angavikelekile afihlwe kukhodi yakudala.
- I-Xygeni izenzekela ngokuzenzakalelayo ukuthola, ukubeka phambili, kanye nokulungisa ukuze ithimba lakho likwazi ukugxila ezicini zokubhala, hhayi ukuphishekela ubuthakathaka.
Isiphetho: Ungazethembi Izihlungi. Zivikeleke Ngomklamo.
Ukuthembela emisebenzini efana i-stripchar Kungase kuzwakale sengathi kuyisisombululo esisheshayo, kodwa kudala umuzwa wokuvikeleka ongamanga. Abahlaseli bashintsha ngokushesha kunezihlungi zezintambo. Okuwukuphela kwendlela ethembekile yokumisa ukuhlaselwa ngokujova ukubhala ikhodi evikelekile ngomklamo, nokuphoqelela lowo mklamo yonke indawo.
Amathuluzi afana ne-Xygeni akusiza ukuthi wenze lokho ngokuzenzakalelayo. Kusukela ku- pull request kuya pipeline, babamba lokho izihlungi zakho ezingakwenzi, bese bekulungisa ngaphambi kokuba kufinyelele ekukhiqizweni.
