Excel 导入中的 SQL 注入漏洞 [重复]

Excel 导入中的 SQL 注入漏洞

vba
Sub ImportData()
    Dim conn As New ADODB.Connection
    Dim rs As New ADODB.Recordset
    Dim strSQL As String
    Dim id As String
    Dim name As String
    Dim salary As String
    
    ' 连接数据库
    conn.Open "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\path\to\database.accdb"
    
    ' 遍历 Excel 数据行
    For i = 2 To Worksheets("import_data").UsedRange.Rows.Count
        id = CStr(Worksheets("import_data").Cells(i, 1).Value)
        name = CStr(Worksheets("import_data").Cells(i, 2).Value)
        salary = CStr(Worksheets("import_data").Cells(i, 3).Value)
        
        ' 构造 SQL 语句
        strSQL = "INSERT INTO employees (id, name, salary) VALUES (" & id & ", '" & name & "', " & salary & ")"
        
        ' 执行 SQL 语句
        conn.Execute strSQL
    Next i
    
    ' 关闭连接
    conn.Close
End Sub