近几年来,信息化建设日趋成熟,业务的日常运转已经开始依赖于信息系统的支持。随着信息系统的广泛应用,信息系统的安全性问题就成为了热点课题。信息系统安全性最大的麻烦就来自于SQL注入式攻击(SQL Injection Attack)。尽管之前提出了处理SQL注入式攻击的各种方法,但是这些方法都具有很多局限性,大多数仅仅处理了SQL注入的一些问题。本文提出了一种效率高、安全性强又易于扩展的解决SQL注入式攻击的设计方案。 In recent years, the construction of informatization has matured and the daily operation of the business has begun to depend on the support of the information system. With the wide application of information system, the security of information system has become a hot topic. The biggest pitfalls of information system security come from SQL Injection Attack. Although various approaches to deal with SQL injection attacks have been previously proposed, these methods have many limitations, and most deal only with some issues with SQL injection. In this paper, we propose a design scheme to solve SQL injection attacks with high efficiency, security and easy expansion.