[转载] – SQL Injection Attacks and Some Tips on How to Prevent Them
Encrypt sensitive data.
Access the database using an account with the least privileges necessary.
Install the database using an account with the least privileges necessary.
Ensure that data is valid.
Do a code review to check for the possibility of second-order attacks.
Use parameterised queries.
Use stored procedures.
Re-validate data in stored procedures.
Ensure that error messages give nothing away about the internal architecture of the application or the database.
About the Author
Colin Angus Mackay