最近群里好多人讨论oracle安全问题,今天找了些资料学习了下
获取Oracle当前会话些属性 (对于sql注射环境判断很有用哦)
SYS_CONTEXT 返回是和上下文名称空间相关属性值这个可以用在SQL和PL/SQL语句中
注意: SYS_CONTEXT 返回是用户会话期间属性所以你无法使用它在并行查询或实时应用集群环境
对于名称空间和变量, 你可以定义它(们)为常量串也可以定义个变量来代替名称空间或属性串名称空间必须是已经在数据库中定义好, 并且相关参数和值已经被指定到DBMS_SESSION中名称空间必须是个合法SQL标识符变量名字可以是任意串它们不区分大小写, 但是长度不能超出30个字节
返回数据类型是VARCHAR2回归值缺省最大长度是256个字节你也可以通过设置参数length来修改这个缺省长度值值合法长度范围是1到4000字节(如果你指定值不在这个范围内, Oracle将使用缺省长度)
Oracle9i 提供了个内置"USERENV"名称空间, 用来表示当前会话信息该名称空间预定义参数如表1, 表最后列标识了返回值长度
语法:
SYS_CONTEXT(, attribute[, length])
例子:
select SYS_CONTEXT ('USERENV', 'TERMINAL') TERMINAL,
SYS_CONTEXT ('USERENV', 'LANGUAGE') LANGUAGE,
SYS_CONTEXT ('USERENV', 'SESSIONID') SESSIONID,
SYS_CONTEXT ('USERENV', 'INSTANCE') INSTANCE,
SYS_CONTEXT ('USERENV', 'ENTRYID') ENTRYID,
SYS_CONTEXT ('USERENV', 'ISDBA') ISDBA,
SYS_CONTEXT ('USERENV', 'NLS_TERRITORY') NLS_TERRITORY,
SYS_CONTEXT ('USERENV', 'NLS_CURRENCY') NLS_CURRENCY,
SYS_CONTEXT ('USERENV', 'NLS_CALENDAR') NLS_CALENDAR,
SYS_CONTEXT ('USERENV', 'NLS_DATE_FORMAT') NLS_DATE_FORMAT,
SYS_CONTEXT ('USERENV', 'NLS_DATE_LANGUAGE') NLS_DATE_LANGUAGE,
SYS_CONTEXT ('USERENV', 'NLS_SORT') NLS_SORT,
SYS_CONTEXT ('USERENV', 'CURRENT_USER') CURRENT_USER,
SYS_CONTEXT ('USERENV', 'CURRENT_USERID') CURRENT_USERID,
SYS_CONTEXT ('USERENV', 'SESSION_USER') SESSION_USER,
SYS_CONTEXT ('USERENV', 'SESSION_USERID') SESSION_USERID,
SYS_CONTEXT ('USERENV', 'PROXY_USER') PROXY_USER,
SYS_CONTEXT ('USERENV', 'PROXY_USERID') PROXY_USERID,
SYS_CONTEXT ('USERENV', 'DB_DOMAIN') DB_DOMAIN,
SYS_CONTEXT ('USERENV', 'DB_NAME') DB_NAME,
SYS_CONTEXT ('USERENV', 'HOST') HOST,
SYS_CONTEXT ('USERENV', 'OS_USER') OS_USER,
SYS_CONTEXT ('USERENV', 'EXTERNAL_NAME') EXTERNAL_NAME,
SYS_CONTEXT ('USERENV', 'IP_ADDRESS') IP_ADDRESS,
SYS_CONTEXT ('USERENV', 'NETWORK_PROTOCOL') NETWORK_PROTOCOL,
SYS_CONTEXT ('USERENV', 'BG_JOB_ID') BG_JOB_ID,
SYS_CONTEXT ('USERENV', 'FG_JOB_ID') FG_JOB_ID,
SYS_CONTEXT ('USERENV', 'AUTHENTICATION_TYPE') AUTHENTICATION_TYPE,
SYS_CONTEXT ('USERENV', 'AUTHENTICATION_DATA') AUTHENTICATION_DATA
FROM DUAL;
下面语句返回登录用户名字:
CONNECT OE/OE
select SYS_CONTEXT ('USERENV', 'SESSION_USER')
FROM DUAL;
SYS_CONTEXT ('USERENV', 'SESSION_USER')


网上找
[code]AUTHENTICATION_DATA
Data being used to authenticate the login user. For X.503 certicate authenticated sessions, this field s the context of the certicate in HEX2 format.
256

Note: You can change the value of the AUTHENTICATION_DATA attribute using the length parameter of the syntax. Values of up to 4000 are accepted. This is the _disibledevent=protocol' portion of the connect .
256
NLS_CALENDAR
The current calendar of the current session.
62
NLS_CURRENCY
The currency of the current session.
62
NLS_DATE_FORMAT
The date format for the session.
62
NLS_DATE_LANGUAGE
The language used for expressing dates.
62
NLS_SORT
BINARY or the linguistic sort basis.
62
NLS_TERRITORY
The territory of the current session.
62
OS_USER
Operating system username of the client process that initiated the database session
30
PROXY_USER
Name of the database user who opened the current session on behalf of SESSION_USER.
30
PROXY_USERID
Identier of the database user who opened the current session on behalf of SESSION_USER.
30
SESSION_USER
Database user name by which the current user is authenticated. This value res the same throughout the duration of the session.
30
SESSION_USERID
Identier of the database user name by which the current user is authenticated.
30
SESSIONID
The auditing session identier. You cannot use this option in distributed SQL statements.
30
TERMINAL
The operating system identier for the client of the current session. In distributed SQL statements, this option s the identier for your local session. In a distributed environment, this is supported only for remote select statements, not for remote insert, update, or delete operations. (The length of this parameter may vary by operating system.)