结构化查询语言Web Security 鈥_Part 3_ SQL Injection.pptVIP

Infrastructure Practice – Use security scanning tools The best security measure is one that catches problems before they are revealed. Applications should be automatically scanned for vulnerabilities. Reveals vulnerabilities above and beyond simple penetration testing. Many excellent products: Rational APPSCAN from IBM (was Watchfire) Acunetix Infrastructure Practice – Example /products/securesphere/ Performance MetricSecureSphere Throughput up to 2 Gbps . SQL Requests/sec up to 200,000 Other Injections /copy.php?name=username copy.php file includes system(“cp temp.dat $name.dat”) User ca