org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-build-isolation --no-binary :all: things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-build-isolation --no-binary :all: things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-build-isolation --no-binary :all: things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-build-isolation --no-binary :all: things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-binary :all: falcon Installing on things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-binary :all: falcon Installing on things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share 2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded # yet, or perhaps is a single cluster that all data centers have to share 2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express

不正确的处理转义字符 n 不正确的处理类型 n 不正确的处理联合查询 n 不正确的处理错误 n 不正确的处理多次提交 q 不安全的数据库配置 n 默认预先安装的用户 n 以root、SYSTEM 或者Administrator权限系统用户来运行 n 默认允许很多系统函数（如xp_cmdshell, OPENROWSET 等） 20 原理 n SQL注入步骤 q 找出数据入口； 执行文件操作、系统命令操作、执行系统程序等 n cmd.exe?format+c:/ n Exec n System() 40 原理 n 场景代码如下： ";; system("ls -­al ".$dir);; echo "";; } ?> 41 原理 原理 n 构造： http://www.test.com/ex1.php?dir= |cat /etc/passwd n 则命令变成了 system("ls -­al |cat /etc/passwd");; 42 操作系统命令注入DEMO 风险 n 信息泄露 n 系统破坏 44 防护方法 n 尽量不要执行外部命令 n 运用 safe_mode_exec_dir指定可执行文件的路径

org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an “AS IS” BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express turn detect the presence of Cython and then compile (AKA cythonize) the Falcon framework with the system’s default C compiler. $ pip install cython $ pip install --no-binary :all: falcon Installing on things to another service; this example shows how you might # send parts of an API off to a legacy system that hasn't been upgraded 22 Chapter 5. Documentation Falcon Documentation, Release 1.0.0 # yet