由于电子邮件地址有很多有效字符,是否有任何有效的电子邮件地址本身可以是XSS攻击或sql注入？我在网上找不到任何相关信息.
The local-part of the e-mail address
may use any of these ASCII characters:
- Uppercase and lowercase English letters (a–z,A–Z)
- Digits 0 to 9
- Characters ! # $% & ‘ * + – / = ? ^ _ ` { | } ~
- Character . (dot,period,full stop) provided that it is not the last
character,and provided also that it does not appear two or
more times consecutively (e.g. John..Doe@example.com).
http://en.wikipedia.org/wiki/E-mail_address#RFC_specification
我不是在问如何防止这些攻击(我已经在使用参数化查询和转义/ HTML净化器),这更像是一个概念验证.
首先想到的是’OR 1 = 1–@gmail.com,但不允许使用空格.所有sql注入都需要空格吗？
