防止sql注入最好的辦法是對于提交后臺的所有數據都進行過濾轉義。

對于簡單的情況，比如包含單引號' , 分號;, <, >, 等字符可通過rewrite直接重訂向到404頁面來避免。

用rewrite有個前提需要知道，一般用rewrite進行正則匹配只能匹配到網頁的URI，也就是url中?前部分，?以后部分是請求參數。

問號后面的請求參數，在nginx用$query_string表 示，不能在rewrite中匹配到，需要用if判斷

例如，對于參數中帶有單引號的'進行匹配然后定向到錯誤頁面，

/plus/list.php?tid=19&mid=1124'rewrite ^.*([;'<>]).* /error.html break;

直接寫這樣的一條重寫肯定不會正確匹配，因為rewrite參數只會匹配請求的uri，也就是/plus/list.php部分。

需要使用$query_string 借助if進行判斷，如果查詢串種包含特殊字符，返回404。

if ( $query_string ~* ".*[;'<>].*" ){return 404;}

下面來分享一個配置文件實例：

server {## 禁SQL注入 Block SQL injectionsset $block_sql_injections 0;if ($query_string ~ “union.*select.*(“) {set $block_sql_injections 1;}if ($query_string ~ “union.*all.*select.*”) {set $block_sql_injections 1;}if ($query_string ~ “concat.*(“) {set $block_sql_injections 1;}if ($block_sql_injections = 1) {return 444;}## 禁掉文件注入set $block_file_injections 0;if ($query_string ~ “[a-zA-Z0-9_]=http://”) {set $block_file_injections 1;}if ($query_string ~ “[a-zA-Z0-9_]=(..//?)+”) {set $block_file_injections 1;}if ($query_string ~ “[a-zA-Z0-9_]=/([a-z0-9_.]//?)+”) {set $block_file_injections 1;}if ($block_file_injections = 1) {return 444;}## 禁掉溢出攻擊set $block_common_exploits 0;if ($query_string ~ “(<|%3C).*script.*(>|%3E)”) {set $block_common_exploits 1;}if ($query_string ~ “GLOBALS(=|[|%[0-9A-Z]{0,2})”) {set $block_common_exploits 1;}if ($query_string ~ “_REQUEST(=|[|%[0-9A-Z]{0,2})”) {set $block_common_exploits 1;}if ($query_string ~ “proc/self/environ”) {set $block_common_exploits 1;}if ($query_string ~ “mosConfig_[a-zA-Z_]{1,21}(=|%3D)”) {set $block_common_exploits 1;}if ($query_string ~ “base64_(en|de)code(.*)”) {set $block_common_exploits 1;}if ($block_common_exploits = 1) {return 444;}## 禁spam字段set $block_spam 0;if ($query_string ~ “b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)b”) {set $block_spam 1;}if ($query_string ~ “b(erections|hoodia|huronriveracres|impotence|levitra|libido)b”) {set $block_spam 1;}if ($query_string ~ “b(ambien|bluespill|cialis|cocaine|ejaculation|erectile)b”) {set $block_spam 1;}if ($query_string ~ “b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)b”) {set $block_spam 1;}if ($block_spam = 1) {return 444;}## 禁掉user-agentsset $block_user_agents 0;# Don't disable wget if you need it to run cron jobs!#if ($http_user_agent ~ “Wget”) {# set $block_user_agents 1;#}# Disable Akeeba Remote Control 2.5 and earlierif ($http_user_agent ~ “Indy Library”) {set $block_user_agents 1;}# Common bandwidth hoggers and hacking tools.if ($http_user_agent ~ “libwww-perl”) {set $block_user_agents 1;}if ($http_user_agent ~ “GetRight”) {set $block_user_agents 1;}if ($http_user_agent ~ “GetWeb!”) {set $block_user_agents 1;}if ($http_user_agent ~ “Go!Zilla”) {set $block_user_agents 1;}if ($http_user_agent ~ “Download Demon”) {set $block_user_agents 1;}if ($http_user_agent ~ “Go-Ahead-Got-It”) {set $block_user_agents 1;}if ($http_user_agent ~ “TurnitinBot”) {set $block_user_agents 1;}if ($http_user_agent ~ “GrabNet”) {set $block_user_agents 1;}  if ($http_user_agent ~ "WebBench") {    set $block_user_agents 1;  }  if ($http_user_agent ~ "ApacheBench") {    set $block_user_agents 1;  }  if ($http_user_agent ~ ^$) {    set $block_user_agents 1;  }  if ($http_user_agent ~ "Python-urllib") {    set $block_user_agents 1;  }if ($block_user_agents = 1) {return 444;}}