由于SQL注入导致进入数据库驱动的Web开发感到紧张[重复]

Question

Possible Duplicates:
What is SQL injection?
In PHP when submitting strings to the DB should I take care of illegal characters using htmlspecialchars() or use regex?

I really need someone to clearly explain how to handle hackers and if it's really as complicated as it sounds.

Answer 1

The basic thing to do about sql injection is to use parameters in your queries.

So, this is BAD, and could be used for injecting hackers's sql:

mySqlCommand.Text = "select * from mytable where FirstName = " + tbox.Text;

Do it this way:

mySqlCommand.Parameters.Add("@FirstName", tbox.Text)
mySqlCommand.Text = "select * from mytable where FirstName = @FirstName";

Note: I used "pseudo code". I Don't know php or mysql, but the same principle should apply.