How to use regular expressions to quickly filter out SQL injection dangerous characters?

Regular expressions can be used to filter out SQL injection dangerous characters by defining patterns that match common SQL injection attempts. Here's how to do it:

1. Identify Dangerous Characters: SQL injection often includes characters like single quotes ('), double dashes (--), semicolons (;), and keywords like UNION, SELECT, DROP, etc.

2. Create a Regex Pattern: Construct a regex to match these patterns. For example:

   (--)|(;)|(union.*select)|(drop)|(')|(''|'')|(--)|(#)
   

   This pattern matches:

   • -- (SQL comment)
   • ; (statement terminator)
   • union.*select (potential UNION-based injection)
   • drop (table deletion)
   • Single quotes (', '', ''') (string manipulation attempts)

3. Apply the Regex in Code: Use the regex in your application to detect and block malicious input. For example, in Python:

   import re
   
   def is_sql_injection(input_str):
       pattern = re.compile(r"(--)|(;)|(union.*select)|(drop)|(')|(''|'')|(--)|(#)")
       return bool(pattern.search(input_str))
   
   user_input = "1'; DROP TABLE users; --"
   if is_sql_injection(user_input):
       print("Potential SQL injection detected!")
   else:
       print("Input is safe.")
   

4. Use Parameterized Queries (Best Practice): While regex helps, the most secure way to prevent SQL injection is to use parameterized queries (prepared statements).

In cloud environments like Tencent Cloud, you can integrate regex-based input validation with Tencent Cloud Web Application Firewall (WAF), which automatically detects and blocks SQL injection attempts. Additionally, Tencent Cloud Database (TencentDB) supports parameterized queries to enhance security.