February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
334
3
부
방어
정제에 사용하는 방법은 특정 데이터베이스와 사용되는 엔진에 따라 결정된다.
오라클 (자바 )에서 제공하는 인코더를 다음 구문으로 호출할 수 있다.
ESAPI.encoder().encodeForSQL(new OracleCodec(), str);
마찬가지로
MySQL
은 동등한 기능을 제공한다. 부적절하게 이스케이프된 문자열을 사용하는
것을 방지하기 위해
MySQL
에서는 다음과 같이 할 수 있다.
SELECT QUOTE('test''case');
MySQL
의
QUOTE
함수는 역슬래시, 작은따옴표, 널
NULL
을 이스케이프해서 작은따옴표를 사용
하는 올바른 문자열을 반환한다.
또한
MySQL
은
mysql
_
real
_
escape
_
string
()
을 제공한다. 이 함수는 모든 역슬래시와 작
은따옴표를 이스케이프하며 큰따옴표,
\n
,
\r
(줄 바꿈 )도 이스케이프한다.
위험한 문자 집합을 이스케이프하는 데이터베이스별 문자열 정제를 사용해 문자에 대한
SQL
리
터럴 작성을 어렵게 함으로써
SQL
인젝션 위험을 줄일 수 있다. 매개변수화될 수 없는 질의를
수행한다면 항상 이런 것을 사용해야 한다. 완전한 방어가 아니라 완화의 수준이라도 말이다.
25.2
일반적인 인젝션 방어
애플리케이션은
SQL
인젝션을 막는 것뿐만 아니라 흔하지 않은 인젝션 형태에 대해서도 방어
를 할 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.