Software Test (i) error

Objective:

Just start to write the program, because there will be few things, so just the pursuit can complete the requirements, and did not check the security of the program, so there will be a lot of security problems.

Experiencing:

Here are some of the problems that you have just learned from PHP.

As we all know, in Web applications, submitting information is the most basic and most common activity, and what the user actually submits is not predictable. And I started out for the sake of convenience, and there was no concept of security, so I did not check the information submitted. Until the accidental content is not entered in the complete submission, so I have to directly modify the database line .... Then I noticed that this was not going to work, so I began to learn to determine whether the content of the submission is empty, so that the beginning of contact with JavaScript before the submission of the judgment and determine the operation. Then as I complacent, the book tells me there is something called SQL injection in the world,,,,

　　

　　SQL injection, by inserting a SQL command into a Web form to submit or entering a query string for a domain name or page request, eventually achieves a malicious SQL command that deceives the server.

Novice php like me, always like to splice SQL statements , and then a malicious person can easily use or or and the SQL statement stitching to achieve illegal query (select) or Delete (delete) the effect of database data, it is easy to have a devastating impact on the Web application, I have also tried, the results of their own database to easily display all the data,, and can even clear the database,,,,

　　

Then I began to learn the sensitive character filtering and use of security functions,, including after learning JSP and the database to do a lot of work to do a large number of checks, this should be the biggest bug I have found so far,,, but also the larger not yet found.

Heard:

　　Here's a bug I heard about.

Now the global League of Heroes (LOL), in the May 2012 get started during the history of the biggest bug--------card talent bug, the bug used very simple, directly with the Kingsoft game can modify the talent (seemingly modified memory?) ), directly leading to Summoner skills without CD, simply speaking, the player can use this bug to give himself unlimited blood, infinite teleport,,, this game can't play ... This matter affects tens of thousands of players, the impact of the very bad, the parties are sealed number.

A recent bug is a game prop price correction error, the direct drop of the double,, resulting in tens of thousands of people crazy purchase, involving at least million RMB.

(Why this kind of good thing I missed,,)

Above,, my knowledge level is not enough, still need to study hard,,

Software Test (i) error