SQL injection
Cyber security Lesson 14 2:01 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Most apps look up a user by building a query out of a string.
大多数应用查一个用户，靠的是把一条查询"拼"出来。
You type your name into a box, and the app glues what you typed into the query.
你在输入框里敲下名字，应用把你敲的东西粘进查询里。
Type Mei, and the query asks for the row where name equals Mei.
敲 Mei，查询问的就是 name 等于 Mei 的那一行。
It works, it is easy, and it is the bug.
它能用，它简单，而它就是那个漏洞。
Whatever the box contains lands between those two quotes — that is the whole vulnerability.
输入框里装着什么，就落在那两个引号之间—— 整个漏洞就在这里。
So an attacker does not type a name.
于是攻击者不打名字。
They type a quote, then O R, then one equals one.
他打一个引号，然后是 OR，然后是 1 等于 1。
The quote closes the string early and the rest becomes part of the query.
那个引号把字符串提前闭合，剩下的部分就变成了查询的一部分。
Watch what the query becomes: name equals empty, OR one equals one.
看这条查询变成了什么：name 等于空，或者 1 等于 1。
One equals one is always true, so the database hands back every single user, and the login is bypassed.
1 等于 1 恒为真， 于是数据库把每一个用户都交了出来，登录被绕过了。
That is S Q L injection, the most famous web attack there is.
这就是 SQL 注入，网络上最有名的那种攻击。
The fix is not to filter clever strings — it is to stop building queries out of strings at all.
解决办法不是去过滤那些花招字符串—— 而是根本不要再用字符串来拼查询。
A parameterised query leaves a placeholder, and the database fills it in separately, treating whatever arrives strictly as a value and never as code.
参数化查询留下一个占位符， 由数据库单独把它填进去， 并且严格把送进来的东西当作"值"，绝不当作代码。
Run the same attack string through it and it is merely a name to look up.
把刚才那串攻击文字再送一次，它就只是一个要查的名字。
No user is called that, so nothing comes back.
没有哪个用户叫这个，所以什么也查不出来。
And alongside it, apply least privilege to the app's own database account.
与此同时，也给这个应用自己的数据库账号套上最小权限。
Four things to take with you.
带走四点。
One: never build a query by joining raw input into text.
第一：绝不要把原始输入拼进查询文本里。
Two: injected S Q L is treated as code, not as data.
第二：被注入的 SQL 会被当成代码，而不是数据。
Three: parameterised queries treat input as a value.
第三：参数化查询把输入当作值来处理。
Four: give the app's database account least privilege.
第四：给应用的数据库账号套上最小权限。
Now write a precise, safe lookup in the task below.
现在去下面的题里写一条精确而安全的查询。