Ëæ×Å»¥ÁªÍøµÄ·¢Õ¹£¬ÍøÕ¾ÒѾ³ÉΪÁËÆóÒµºÍ¸öÈËչʾ×Ô¼ºµÄÖØÒªÆ½Ì¨¡£È»¶ø£¬Ëæ×ÅÍøÕ¾µÄ²»¶ÏÔö¶à£¬ÍøÕ¾°²È«ÎÊÌâÒ²Ô½À´Ô½Í»³ö¡£±¾ÎĽ«½éÉÜÍøÕ¾¿ª·¢ÖеݲȫÎÊÌâºÍ·À·¶´ëÊ©¡£
SQL×¢Èë¹¥»÷ÊÇÖ¸¹¥»÷Õßͨ¹ýÔÚÊäÈë¿òÖÐÊäÈë¶ñÒâ´úÂ룬´Ó¶ø»ñÈ¡ÍøÕ¾Êý¾Ý¿âÖеÄÃô¸ÐÐÅÏ¢¡£¹¥»÷Õß¿ÉÒÔͨ¹ýSQL×¢Èë¹¥»÷»ñÈ¡Óû§µÄÕ˺š¢ÃÜÂëµÈÃô¸ÐÐÅÏ¢£¬´Ó¶ø¶ÔÓû§Ôì³ÉËðʧ¡£
XSS¹¥»÷ÊÇÖ¸¹¥»÷Õßͨ¹ýÔÚÍøÕ¾ÖвåÈë¶ñÒâ½Å±¾£¬´Ó¶ø»ñÈ¡Óû§µÄÃô¸ÐÐÅÏ¢¡£¹¥»÷Õß¿ÉÒÔͨ¹ýXSS¹¥»÷»ñÈ¡Óû§µÄÕ˺š¢ÃÜÂëµÈÃô¸ÐÐÅÏ¢£¬´Ó¶ø¶ÔÓû§Ôì³ÉËðʧ¡£
ÎļþÉÏ´«Â©¶´ÊÇÖ¸¹¥»÷Õßͨ¹ýÉÏ´«¶ñÒâÎļþ£¬´Ó¶ø»ñÈ¡ÍøÕ¾·þÎñÆ÷µÄ¿ØÖÆÈ¨¡£¹¥»÷Õß¿ÉÒÔͨ¹ýÎļþÉÏ´«Â©¶´»ñÈ¡ÍøÕ¾·þÎñÆ÷µÄ¿ØÖÆÈ¨£¬´Ó¶ø¶ÔÍøÕ¾Ôì³ÉËðʧ¡£
¿ª·¢ÍøÕ¾
ʹÓòÎÊý»¯²éѯ¿ÉÒÔ·ÀÖ¹SQL×¢Èë¹¥»÷¡£²ÎÊý»¯²éѯÊÇÖ¸½«Óû§ÊäÈëµÄÊý¾Ý×÷Ϊ²ÎÊý´«µÝ¸øÊý¾Ý¿â£¬¶ø²»Êǽ«Óû§ÊäÈëµÄÊý¾ÝÖ±½ÓÆ´½Óµ½SQLÓï¾äÖС£
¹ýÂËÓû§ÊäÈë¿ÉÒÔ·ÀÖ¹XSS¹¥»÷¡£¹ýÂËÓû§ÊäÈëÊÇÖ¸¶ÔÓû§ÊäÈëµÄÊý¾Ý½øÐйýÂËÖÆ×÷ÍøÕ¾£¬È¥³ýÆäÖеĶñÒâ½Å±¾¡£
ʹÓÃCSRFÁîÅÆ¿ÉÒÔ·ÀÖ¹CSRF¹¥»÷¡£CSRFÁîÅÆÊÇÖ¸ÔÚÓû§ÇëÇóÖÐÌí¼ÓÒ»¸öËæ»úµÄÁîÅÆÖÇÄÜÍøÕ¾¿ª·¢£¬´Ó¶ø·ÀÖ¹¹¥»÷ÕßαÔìÓû§µÄÇëÇó¡£
¶ÔÉÏ´«Îļþ½øÐмì²é¿ÉÒÔ·ÀÖ¹ÎļþÉÏ´«Â©¶´¡£¼ì²éÉÏ´«ÎļþÊÇÖ¸¶ÔÉÏ´«µÄÎļþ½øÐмì²é£¬È·±£ÉÏ´«µÄÎļþÊǰ²È«µÄ¡£
ÍøÕ¾¿ª·¢ÖеݲȫÎÊÌâºÍ·À·¶´ëÊ©ÊÇÍøÕ¾ÖÆ×÷µÄÖØÒª·½Ãæ¡£¿ÉÒÔͨ¹ýʹÓòÎÊý»¯²éѯ¡¢¹ýÂËÓû§ÊäÈ롢ʹÓÃCSRFÁîÅÆ¡¢¶ÔÉÏ´«Îļþ½øÐмì²éµÈ·½Ê½À´·À·¶°²È«ÎÊÌ⡣ͬʱ£¬ÍøÕ¾¿ª·¢ÕßÒ²Ó¦¸Ã¶¨ÆÚ¸üÐÂÍøÕ¾µÄ°²È«´ëÊ©£¬ÒÔ±£Ö¤ÍøÕ¾µÄ°²È«ÐÔ¡£
£¬