????????????????????????????????????????????????????????

 

class Program
{
private static string connectionString = "Data Source=.;Initial Catalog=Test;Integrated Security=True";
static void Main(string[] args)
{
Login("b"?? "a");
Login("b' or 1=1--"?? "a");
}
private static void Login(string userName?? string password)
{
using (SqlConnection conn = new SqlConnection(connectionString))
{
conn.Open();
SqlCommand comm = new SqlCommand();
comm.Connection = conn;
//???????????????????
comm.CommandText = "select COUNT(*) from Users where Password = @Password and UserName = @UserName";
comm.Parameters.AddRange(
new SqlParameter[]
{
new SqlParameter("@Password"?? SqlDbType.VarChar)
{Value = password}??
new SqlParameter("@UserName"?? SqlDbType.VarChar)
{Value = userName}??
});
comm.ExecuteNonQuery();
}
}
}

?????????е?SQL ?????????
????exec sp_executesql N'select COUNT(*) from Users where Password = @Password and UserName = @UserName'??N'@Password varchar(1)??@UserName varchar(1)'??@Password='a'??@UserName='b'
????exec sp_executesql N'select COUNT(*) from Users where Password = @Password and UserName = @UserName'??N'@Password varchar(1)??@UserName varchar(11)'??@Password='a'??@UserName='b'' or 1=1—'
?????????????????????????????Щ???飺
????1?????????????????? @UserName='b'' or 1=1—'
????2????м??????
?????????м??????????????????SQL???
???????????SQL????????
???????д?????SQL ?????????????????a??????????b?????????????????
??????????SQL?????SQL????????????????(??????a??????????????b??) ????1=1 ?????????????????
???????????SQL?????????????????????????????????????????????м??????????????SQL???????????????????????????????????????????SQL???岻????????????SQL???????????????????????????????????????м????
??????????????????м?????????SQL???????????SQL???????п????仯??????????????仯??
??????SQL Server ?в????м??????????????????

 

DBCC FreeProccache
select total_elapsed_time / execution_count ??????total_logical_reads/execution_count ???????
usecounts ?????????SUBSTRING(d.text?? (statement_start_offset/2) + 1??
((CASE statement_end_offset
WHEN -1 THEN DATALENGTH(text)
ELSE statement_end_offset END
- statement_start_offset)/2) + 1) ?????? from sys.dm_exec_cached_plans a
cross apply sys.dm_exec_query_plan(a.plan_handle) c
??sys.dm_exec_query_stats b
cross apply sys.dm_exec_sql_text(b.sql_handle) d
--where a.plan_handle=b.plan_handle and total_logical_reads/execution_count>4000
ORDER BY total_elapsed_time / execution_count DESC;
18EFAED775BF4DB9A36C57B39EC6913D