Server prevents illegal login

1, security configuration of the database, such as the account /password /permissions used by your program to connect to the database, if you are browsing the news, you can use read-only permissions; you can use different accounts /permissions for different modules In addition, which stored procedures of the database can be called, but also strictly configured, not all disabled (especially cmd), to prevent system calls using the database stored procedure after injection;

2. When obtaining the parameters submitted by the client, perform strict filtering, including parameter length, parameter type, etc.;

3. Strict protection for the administrator background. If conditions permit, it should be set to only Allow specific IP access (for example, only allow administrator network segment access) —— this should be based on actual conditions;

4, security configuration of the operating system to prevent the function of calling the system after injection For example, transfer

cmd.exe/tftp.exe/ftp.exe/net.exe

to all other directories and make the directory Privilege assignment;

5, set network access control;

6, if possible, configure content filtering for HTTP, filter viruses, malicious scripts, etc.;

7. If necessary, you can consider choosing HTTPS, which can prevent many injection tools from scanning. When I developed the injection detection tool myself, I thought about supporting HTTPS, but it has not been implemented yet.

I believe you also see it. In general, the program mainly considers permissions, parameter filtering, etc. The permissions mainly include IIS browsing permissions and database calling permissions. In addition, consider the security configuration of the database and operating system. In addition, I don't know if you will use components developed by others during the development process, such as image uploading. Have you studied the security of such components? Or most people will use them during the development process. The open code provided on the Internet, in the book, such as user login verification, etc., these public code, also to study its security issues.