Shulou(Shulou.com)06/02 Report--

This article focuses on "how to modify sql injection", interested friends may wish to take a look. The method introduced in this paper is simple, fast and practical. Let's let the editor take you to learn how to modify sql injection.

Recently, the company's security department conducted a static security scan of the code and found some security problems. Because the company's project was written in mybatis, it found some bug injected by sql, mainly caused by the $problem.

One is that the in query uses $, and the other is that order by uses it.

The in tag $is changed to #

Original statement:

And

ID in (${ids})

After modification

And

# {item} Zhengzhou good go to birthmark Hospital http://m.zykdbhk.com/

Use the foreach tag instead of the $symbol. Note here that collection needs to write the parameters of the entity class, not ids, but cdt.ids.

Item is the value of each item.

Order by $

This did not find a very good way to modify, one is to check the input value in the code, and exclude the related fields.

At this point, I believe you have a deeper understanding of "how to modify sql injection", might as well come to the actual operation of it! Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.