資料庫索引簡介：解決查詢延遲

Sun, 25 May 2025 00:00:00 +0900

介紹

隨著 Web 應用程式的擴展和資料量的成長，後端系統經常面臨查詢延遲等資料庫瓶頸問題。

在沒有適當索引優化的情況下，在具有數十萬筆記錄的表上執行聯接 (JOIN) 操作或複雜的搜尋查詢可能會導致資料庫 CPU 峰值，從而導致最終用戶的回應時間變慢。

SQL Injection 預防: Modern Database Security 指南

Tue, 01 Oct 2024 00:00:00 +0900

SQL injection remains in the OWASP Top 10 despite decades of awareness. The 2023-2024 period saw high-profile breaches in healthcare, e-commerce, and government sectors involving SQLi. While the classic ' OR 1=1 -- attack is well-known, modern variants include second-order injection, blind SQLi (time-based and boolean-based), and out-of-band exfiltration. Prevention is well-understood but poorly executed due to legacy code, ORM misuse, and insufficient testing automation.

Parameterized Queries and Prepared Statements

Prepared statements are the gold standard for SQL injection prevention. They separate SQL logic from data at the database engine level, making it impossible for user input to alter query structure.

Sql on Commentary of Takao

資料庫索引簡介：解決查詢延遲

介紹

SQL Injection 預防: Modern Database Security 指南

Parameterized Queries and Prepared Statements