<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/" xmlns:wfw="http://wellformedweb.org/CommentAPI/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/"><channel><title>goldcattle的专栏</title><link>http://blog.csdn.net/goldcattle/</link><description>Matrix Reload</description><dc:language>zh-CN</dc:language><lastUpdateTime>Thu, 20 Sep 2007 01:43:24 GMT</lastUpdateTime><ttl>60</ttl><item><dc:creator>goldcattle</dc:creator><title>patterns &amp; practices Performance Testing Guidance for Web Applications </title><link>http://blog.csdn.net/goldcattle/archive/2007/09/20/1792175.aspx</link><pubDate>Thu, 20 Sep 2007 01:43:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/09/20/1792175.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1792175.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/09/20/1792175.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1792175.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1792175</trackback:ping><description>Pattern &amp; practice 上出的新文章（书）从事Web Application performance testing的可以看看 &lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1792175.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>SQL injection </title><link>http://blog.csdn.net/goldcattle/archive/2007/08/02/1721893.aspx</link><pubDate>Thu, 02 Aug 2007 01:34:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/08/02/1721893.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1721893.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/08/02/1721893.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1721893.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1721893</trackback:ping><description>SQL injection 
  
最近自己折腾一个数据库的东西，自己研究了一下SQL injection.

SQL injection 看起来还是挺有意思。可以看看youtube 上的一个SQL injection的实例还是比较简单的。http://www.youtube.com/watch?v=MJNJjh4jORY 

 

当然这是最基本的SQL injection了。这种最基本的问题一般都出在query的字段连接上。

SqlCommand cmd = new SqlCommand(
  "SELECT ID, FullName FROM User WHERE Login='"
  + Login.Text
  + "' AND Password='" 
  + Password.Text 
  + "'");

 
这种类型的错误相当常见，在一般情况下这个SQL语句执行没有任何问题，但是如果往用户的密码框里填上

' OR ''='

那么这个验证就被跳过去了。

当然高级的injecition 需要不停的试最终找到你的se&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1721893.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>Fuzz testing </title><link>http://blog.csdn.net/goldcattle/archive/2007/07/12/1685962.aspx</link><pubDate>Thu, 12 Jul 2007 02:31:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/07/12/1685962.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1685962.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/07/12/1685962.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1685962.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1685962</trackback:ping><description>Fuzz Testing&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1685962.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>自动化测试－提高测试效率的途径(1)</title><link>http://blog.csdn.net/goldcattle/archive/2007/05/25/1624905.aspx</link><pubDate>Fri, 25 May 2007 02:04:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/05/25/1624905.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1624905.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/05/25/1624905.aspx#Feedback</comments><slash:comments>1</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1624905.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1624905</trackback:ping><description>自动化测试－提高测试效率的途径
&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1624905.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>XML库的解析效率</title><link>http://blog.csdn.net/goldcattle/archive/2007/04/27/1586514.aspx</link><pubDate>Fri, 27 Apr 2007 00:11:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/04/27/1586514.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1586514.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/04/27/1586514.aspx#Feedback</comments><slash:comments>2</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1586514.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1586514</trackback:ping><description>XML库的解析效率
XML库的解析效率主要包括解析、存储、导出、遍历、修改、XPath定位 等等。 

XML的访问模型主要有三种，DOM， SAX，PULL。 

DOM即Document Object Model，是最常用的XML解析库。DOM 适用的范围是频繁的不定向随机性访问，以及进行 xslt 之类的转换。 例如如果你需要用xpath 查询或者你要遍历, DOM.还是不错的 只读不只读基本上对规模/性能没什么太大影响. BTW XSLT的功能还是相当强大的。 

如果格式基本上固定的单向读取，即不用遍历, 或者一次性遍历, SAX 就是了. 

如果格式比较灵活且对效率要求高 pull 模型适用， XmlLite是基于 pull 模型的。在第四期的MSDN magazine上有关于XML lite的讨论。 

因为 sax 是由 reader 将所有内容推给你，pull 则是在需要的时候将信息从 reader 拉回来，如果一个节点忽略不处理时，sax 引擎后台还是解析pull 则只需要做最简单的 tag 匹配就可跳过。 

DOM在进行解析时基本上也&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1586514.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>=========重新开张=========</title><link>http://blog.csdn.net/goldcattle/archive/2007/04/26/1586486.aspx</link><pubDate>Thu, 26 Apr 2007 23:30:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2007/04/26/1586486.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/1586486.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2007/04/26/1586486.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/1586486.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=1586486</trackback:ping><description>重新开张&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/1586486.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>迭代器使用的注意点</title><link>http://blog.csdn.net/goldcattle/archive/2005/07/29/439438.aspx</link><pubDate>Fri, 29 Jul 2005 17:23:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2005/07/29/439438.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/439438.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2005/07/29/439438.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/439438.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=439438</trackback:ping><description>使用iterator 的注意点&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/439438.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>一道考察递归思想的面试题</title><link>http://blog.csdn.net/goldcattle/archive/2005/02/26/303176.aspx</link><pubDate>Sat, 26 Feb 2005 17:48:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2005/02/26/303176.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/303176.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2005/02/26/303176.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/303176.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=303176</trackback:ping><description>一道面试题的递归思路的解法。&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/303176.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>mp3player</title><link>http://blog.csdn.net/goldcattle/archive/2005/02/15/287966.aspx</link><pubDate>Tue, 15 Feb 2005 00:35:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2005/02/15/287966.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/287966.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2005/02/15/287966.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/287966.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=287966</trackback:ping><description>mp3player link&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/287966.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>STL 源代码分析</title><link>http://blog.csdn.net/goldcattle/archive/2004/12/19/222247.aspx</link><pubDate>Sun, 19 Dec 2004 23:40:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/12/19/222247.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/222247.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/12/19/222247.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/222247.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=222247</trackback:ping><description>STL源代码分析的第一章基本的东西&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/222247.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>keyboard speed</title><link>http://blog.csdn.net/goldcattle/archive/2004/11/20/188998.aspx</link><pubDate>Sat, 20 Nov 2004 21:47:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/11/20/188998.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/188998.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/11/20/188998.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/188998.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=188998</trackback:ping><description>terrain rendering&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/188998.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>DTW</title><link>http://blog.csdn.net/goldcattle/archive/2004/11/11/177710.aspx</link><pubDate>Thu, 11 Nov 2004 20:18:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/11/11/177710.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/177710.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/11/11/177710.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/177710.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=177710</trackback:ping><description>http://www.ee.columbia.edu/~dpwe/resources/matlab/dtw/&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/177710.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>多用const 尽量不使用#define</title><link>http://blog.csdn.net/goldcattle/archive/2004/10/14/135800.aspx</link><pubDate>Thu, 14 Oct 2004 09:57:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/10/14/135800.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/135800.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/10/14/135800.aspx#Feedback</comments><slash:comments>3</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/135800.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=135800</trackback:ping><description>多用const 尽量不使用#define&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/135800.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>Life</title><link>http://blog.csdn.net/goldcattle/archive/2004/10/12/134144.aspx</link><pubDate>Tue, 12 Oct 2004 21:42:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/10/12/134144.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/134144.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/10/12/134144.aspx#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/134144.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=134144</trackback:ping><description>Life &lt;img src ="http://blog.csdn.net/goldcattle/aggbug/134144.aspx" width = "1" height = "1" /&gt;</description></item><item><dc:creator>goldcattle</dc:creator><title>boost thread (2)</title><link>http://blog.csdn.net/goldcattle/archive/2004/10/12/134113.aspx</link><pubDate>Tue, 12 Oct 2004 21:18:00 GMT</pubDate><guid>http://blog.csdn.net/goldcattle/archive/2004/10/12/134113.aspx</guid><wfw:comment>http://blog.csdn.net/goldcattle/comments/134113.aspx</wfw:comment><comments>http://blog.csdn.net/goldcattle/archive/2004/10/12/134113.aspx#Feedback</comments><slash:comments>3</slash:comments><wfw:commentRss>http://blog.csdn.net/goldcattle/comments/commentRss/134113.aspx</wfw:commentRss><trackback:ping>http://tb.blog.csdn.net/TrackBack.aspx?PostId=134113</trackback:ping><description>boost thread (2)&lt;img src ="http://blog.csdn.net/goldcattle/aggbug/134113.aspx" width = "1" height = "1" /&gt;</description></item></channel></rss>