oracle的一些tips技巧
来源:asp之家 发布时间:2009-03-02 11:06:00
最近群里好多人讨论oracle安全问题,今天找了些资料学习了下
获取Oracle当前会话的一些属性 (对于sql注射的环境判断很有用哦)
SYS_CONTEXT 函数返回是与上下文名称空间相关的属性值。这个函数可以用在SQL和PL/SQL语句中。
注意: SYS_CONTEXT 返回的是用户会话期间的属性,所以,你无法使用它在并行的查询或实时应用集群环境。
对于名称空间和变量, 你可以定义它(们)为常量字符串,也可以定义一个变量,来代替名称空间或属性的字符串。名称空间必须是已经在数据库中定义好的, 并且相关的参数和值已经被指定到DBMS_SESSION中。名称空间必须是一个合法的SQL标识符。变量名字可以是任意的字符串。它们不区分大小写, 但是长度不能超出30个字节。
函数返回的数据类型是VARCHAR2,回归值的缺省最大长度是256个字节。你也可以通过设置函数参数length来修改这个缺省长度值。值的合法的长度范围是1到4000字节。(如果你指定的值不在这个范围内, Oracle将使用缺省长度。)
Oracle9i 提供了一个内置的"USERENV"名称空间, 用来表示当前的会话信息。该名称空间预定义的参数如表1, 表的最后一列标识了返回值的长度。
语法:
SYS_CONTEXT(namespace, attribute[, length])
例子:
select SYS_CONTEXT ('USERENV', 'TERMINAL') TERMINAL,
SYS_CONTEXT ('USERENV', 'LANGUAGE') LANGUAGE,
SYS_CONTEXT ('USERENV', 'SESSIONID') SESSIONID,
SYS_CONTEXT ('USERENV', 'INSTANCE') INSTANCE,
SYS_CONTEXT ('USERENV', 'ENTRYID') ENTRYID,
SYS_CONTEXT ('USERENV', 'ISDBA') ISDBA,
SYS_CONTEXT ('USERENV', 'NLS_TERRITORY') NLS_TERRITORY,
SYS_CONTEXT ('USERENV', 'NLS_CURRENCY') NLS_CURRENCY,
SYS_CONTEXT ('USERENV', 'NLS_CALENDAR') NLS_CALENDAR,
SYS_CONTEXT ('USERENV', 'NLS_DATE_FORMAT') NLS_DATE_FORMAT,
SYS_CONTEXT ('USERENV', 'NLS_DATE_LANGUAGE') NLS_DATE_LANGUAGE,
SYS_CONTEXT ('USERENV', 'NLS_SORT') NLS_SORT,
SYS_CONTEXT ('USERENV', 'CURRENT_USER') CURRENT_USER,
SYS_CONTEXT ('USERENV', 'CURRENT_USERID') CURRENT_USERID,
SYS_CONTEXT ('USERENV', 'SESSION_USER') SESSION_USER,
SYS_CONTEXT ('USERENV', 'SESSION_USERID') SESSION_USERID,
SYS_CONTEXT ('USERENV', 'PROXY_USER') PROXY_USER,
SYS_CONTEXT ('USERENV', 'PROXY_USERID') PROXY_USERID,
SYS_CONTEXT ('USERENV', 'DB_DOMAIN') DB_DOMAIN,
SYS_CONTEXT ('USERENV', 'DB_NAME') DB_NAME,
SYS_CONTEXT ('USERENV', 'HOST') HOST,
SYS_CONTEXT ('USERENV', 'OS_USER') OS_USER,
SYS_CONTEXT ('USERENV', 'EXTERNAL_NAME') EXTERNAL_NAME,
SYS_CONTEXT ('USERENV', 'IP_ADDRESS') IP_ADDRESS,
SYS_CONTEXT ('USERENV', 'NETWORK_PROTOCOL') NETWORK_PROTOCOL,
SYS_CONTEXT ('USERENV', 'BG_JOB_ID') BG_JOB_ID,
SYS_CONTEXT ('USERENV', 'FG_JOB_ID') FG_JOB_ID,
SYS_CONTEXT ('USERENV', 'AUTHENTICATION_TYPE') AUTHENTICATION_TYPE,
SYS_CONTEXT ('USERENV', 'AUTHENTICATION_DATA') AUTHENTICATION_DATA
FROM DUAL;
下面的语句返回登录用户的名字:
CONNECT OE/OE
select SYS_CONTEXT ('USERENV', 'SESSION_USER')
FROM DUAL;
SYS_CONTEXT ('USERENV', 'SESSION_USER')
网上找的
[code]AUTHENTICATION_DATA
Data being used to authenticate the login user. For X.503 certificate authenticated sessions, this field returns the context of the certificate in HEX2 format.
256
Note: You can change the return value of the AUTHENTICATION_DATA attribute using the length parameter of the syntax. Values of up to 4000 are accepted. This is the only attribute of USERENV for which Oracle implements such a change.
AUTHENTICATION_TYPE
How the user was authenticated:
DATABASE: username/password authentication
OS: operating system external user authentication
NETWORK: network protocol or ANO authentication
PROXY: OCI proxy connection authentication
30
BG_JOB_ID
Job ID of the current session if it was established by an Oracle background process. Null if the session was not established by a background process.
30
CLIENT_INFO
Returns up to 64 bytes of user session information that can be stored by an application using the DBMS_APPLICATION_INFO package.
64
CURRENT_SCHEMA
Name of the default schema being used in the current schema. This value can be changed during the session with an alter SESSION SET CURRENT_SCHEMA statement.
30
CURRENT_SCHEMAID
Identifier of the default schema being used in the current session.
30
CURRENT_USER
The name of the user whose privilege the current session is under.
30
CURRENT_USERID
User ID of the user whose privilege the current session is under
30
DB_DOMAIN
Domain of the database as specified in the DB_DOMAIN initialization parameter.
256
DB_NAME
Name of the database as specified in the DB_NAME initialization parameter
30
ENTRYID
The available auditing entry identifier. You cannot use this option in distributed SQL statements. To use this keyword in USERENV, the initialization parameter AUDIT_TRAIL must be set to true.
30
EXTERNAL_NAME
External name of the database user. For SSL authenticated sessions using v.503 certificates, this field returns the distinguished name (DN) stored in the user certificate.
256
FG_JOB_ID
Job ID of the current session if it was established by a client foreground process. Null if the session was not established by a foreground process.
30
HOST
Name of the host machine from which the client has connected.
54
INSTANCE
The instance identification number of the current instance.
30
IP_ADDRESS
IP address of the machine from which the client is connected.
30
ISDBA
TRUE if you currently have the DBA role enabled and FALSE if you do not.
30
LANG
The ISO abbreviation for the language name, a shorter form than the existing 'LANGUAGE' parameter.
62
LANGUAGE
The language and territory currently used by your session, along with the database character set, in this form:
language_territory.characterset
52
NETWORK_PROTOCOL
Network protocol being used for communication, as specified in the 'PROTOCOL=protocol' portion of the connect string.
256
NLS_CALENDAR
The current calendar of the current session.
62
NLS_CURRENCY
The currency of the current session.
62
NLS_DATE_FORMAT
The date format for the session.
62
NLS_DATE_LANGUAGE
The language used for expressing dates.
62
NLS_SORT
BINARY or the linguistic sort basis.
62
NLS_TERRITORY
The territory of the current session.
62
OS_USER
Operating system username of the client process that initiated the database session
30
PROXY_USER
Name of the database user who opened the current session on behalf of SESSION_USER.
30
PROXY_USERID
Identifier of the database user who opened the current session on behalf of SESSION_USER.
30
SESSION_USER
Database user name by which the current user is authenticated. This value remains the same throughout the duration of the session.
30
SESSION_USERID
Identifier of the database user name by which the current user is authenticated.
30
SESSIONID
The auditing session identifier. You cannot use this option in distributed SQL statements.
30
TERMINAL
The operating system identifier for the client of the current session. In distributed SQL statements, this option returns the identifier for your local session. In a distributed environment, this is supported only for remote select statements, not for remote insert, update, or delete operations. (The return length of this parameter may vary by operating system.)
猜你喜欢
- 我们生活在信息繁杂的社会,尤其是在互联网时代,人们开始通过网络开始接触越来越多的信息,那么,如何获取/传递有效而准确的信息将非常重要。在网页
- 写在前面的话:此篇还是asp相关的,相信玩ASP的都有这个感觉,当数据有5万多条时-------just like音乐网,要调用最新的10条
- MySQL支持的两种主要表存储格式MyISAM,InnoDB,上个月做个项目时,先使用了InnoDB,结果速度特别慢,1秒钟只能插入10几条
- 如何向客户端推送“出错信息”?下面是推送代码:服务器端:on error resume nextconn=se
- 代码如下:<% Rem xml缓存类 '----------------------------
- 不同于其他软件项目,互联网项目的开发有其独有的特性。互联网项目开发不同于传统软件项目开发不同于需求定制性的软件开发公司。客户的需求是明确的,
- 前阵子刚完成一个B/S架构的学校办公系统,体会就是表太多,文件太多,而每个文件中类似的操作(代码)也太多了,例如学生信息和教师信息操作,st
- 看下面的一组例子:alert(true.toString());alert(false.toString());alert(1.123.to
- 首先说明,伪造访问来路不是什么光明正大的事情,目的就是为了欺骗服务器。原本以为给 XMLHTTP 对象增加一个 Referer 的heade
- 在我们写样式的时候,页面的CSS在经历几个版本的修改之后,可能有些样式已经用不到了,或许将某些样式更名了而原来的忘了删除,总之页面中可能存在
- 在讲CSS优先级之前,我们得要了解什么是CSS,CSS是用来做什么的。首先,我们对CSS作一个简单的说明:CSS是层叠样式表(Cascadi
- 代码如下: <% Dim oConn, ors, aRows Dim i,j Set oConn=Server.CreateObjec
- 好记星不如烂笔头,适时的总结梳理知识让人更轻松愉快。今天总结下学习和开发中遇到的JavaScript执行顺序的问题,今天挖个坑,以后会慢慢填
- MySQL GUI Tools是一套图形化桌面应用工具套装,可以用来管理MySQL服务器。该套装工具包含三个工具:MySQL Query B
- 互联网是一个飞速发展的行业,任何的止步不前都会导致被淘汰,只是时间早晚的问题,所以一个公司的学习与创新能力是非常重要的,特别是对于一个年轻的
- asp使用session来防止表单多次被提交的方法。formtest.asp' 表单文件<%Randomize&nb
- JAN-1(January) FEB-2(February) MAR-3(March)APR-4(April) MAY-5(Ma
- MS SQL基本语法及实例操作 一:建表并初始化 ============================ create database
- 目前SQL INJECTION的攻击测试愈演愈烈,很多大型的网站和论坛都相继被注入。这些网站一般使用的多为SQL SERVER数据库,正因为
- 1.导言现今的公司需要易访问的和可用性好的商业数据,以便他们可以在全球市场中获得一席之地。与易访问数据的这个需求相呼应的,关系数据库和分析数