SQL 注入攻击的解决办法

 SQL 注入攻击无论是防火墙还是入侵检测系统都无法预防和阻止，唯一的办法是将应用本身的漏洞关闭。例如通过参数的传递配合存贮过程来实现数据库查询，这比动态的构建 sql 语句安全很多。比如在 ASP.net 中通过下面的程序将会避免攻击：

' Visual Basic example
 Dim DS As DataSet
 Dim MyConnection As SqlConnection
 Dim MyCommand As SqlDataAdapter
 Dim SelectCommand As String = "select * from users where username = @username"
 ...
 MyCommand.SelectCommand.Parameters.Add(New SqlParameter("@username",
 SqlDbType.NVarChar, 20))
 MyCommand.SelectCommand.Parameters("@username").Value = UserNameField.Value
 // C# example
 String selectCmd = "select * from Authors where state = @username";
 SqlConnection myConnection = new SqlConnection("server=...");
 SqlDataAdapter myCommand = new SqlDataAdapter(selectCmd, myConnection);
 myCommand.SelectCommand.Parameters.Add(new SqlParameter("@username",
 SqlDbType.NVarChar, 20));
 myCommand.SelectCommand.Parameters["@username"].Value = UserNameField.Value;