??????????????????????а???????????

????????????????????????????????????????????н????????????????С?????????????????????????????????????????????????????

???????????????й????????????????????￡???????????????Щ????????Щ???秵??????????????????????????????

?????????н???xss????????:

????a??url?е????в??????  ??"></script><script>alert("hello??my girl!")</script> ????????

????????????"hello??my girl!"?????

????b??text?????? ??"></script><script>alert("hello??my girl!")</script>?????????

???????????????д??????????????????????????????????б???壻

????c???????????????<img nerror = "alert(123)" src=http://xxx.com>;

???????????????д?????????????????????????????????js?????????????????

????d??????????????д??"></script><script>alert("hello??my girl!")</script>????????????

????????????alert????????????js??????????????????н?????壻

????????

????1????????html?????<title >??<meta  >?е???????????????????????????????п????????????????????????????????????"/></script><script>alert("hello??my girl!")</script>???????????alert??????????</script><script>alert("hello??my girl!")</script>??????????????????"??????/>???????

????2????Щhtml????????url???????.?????.html??????????????????????????п????????????????????????Щ?????????????????????????????"/></script><script>alert("hello??my girl!")</script>?????url = "??????.??"/></script><script>alert("hello??my girl!")</script>"???????????????????????/></script><script>alert("hello??my girl!")</script>"??????????????????

????3??????????????????????e???????????????????????????п????????????????п????????????alert?????????????????ó????????е??

????4????????????????????????url???????????

????????????crsf??

????1?????????????????????????????????token???

????2???????????????crsf???????????????????????????????????

????3??????????????????token???????????

????????

????a???????tokenò?????????????????????????????token??????????????????????????μ???????token????????????????????????????????????????????????url??????????????????????????????????????????μ?token???????????????????????

????b????????????????????????token?????μ???????a???????ε????token???1111??b???????ε????2222.???????????????????token?????????????????a?????????token???1111?????????????????????????????μ????

??????????????????????????????????sql???????????漰???′??л????????

?:???????zfy19821221??51Testing???????????http://www.51testing.com/?159499