Brief Description

The sdl Quick Security References will help you better understand and address common attacks that may be affecting your software, Web sites, and users.

Overview

With the SDL Quick Security References (QSR), the Security Development Lifecycle (SDL) team introduces a series of basic guidance papers designed to address common vulnerabilities from the perspective of multiple business roles - business decision maker, architect, developer, and tester/QA. These papers will help you address a critical business problem now while moving you toward SDL adoption in the future.

PS：有些地方写得还不错，可以参考参考
http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=79042476-951f-48d0-8ebb-89f26cf8979d

dedecms在分页处理上有点问题

e.g:
http://www.dedecms.com/plus/list.php?tid=10&pageno=9

系统用intval对$pageno的值进行了处理，但是intval处理过程中，如果为非正整数时，会赋值为0，系统就会出错。

没有对0进行过滤处理。

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-15,15' at line 7 - Execute Query False! Select arc.*, tp.typedir,tp.typename,tp.isdefault,tp.defaultname,tp.namerule,tp.namerule2,tp.ispart,tp.moresite,tp.siteurl from `dede_archives` arc left join `dede_arctype` tp on arc.typeid=tp.ID where arc.arcrank > -1 And (arc.typeid='10' Or arc.typeid2='10') order by arc.sortrank desc limit -15,15

系统对分页函数$page处理上存在问题。

如果$page的参数为负数的话，程序就会出错。如：http://luoq.net/?page=-1

1是数字，-1就是字符了。暂且叫做数值类型转换上的问题吧。不过没有办法利用。哈哈。比较非主流。

建议1.6的用户加上

对$page进行处理吧。非主流，哈哈！

CheckMD5.php代码

终于还是藏不住了啊。哈哈

http://groups.google.com/group/ph4nt0m/browse_thread/thread/4cf7f46334ff6656

统计PHP代码行数的小bat程序
放到一个PHP文件夹下面，点他，就会自动统计当前目录下面的PHP文件了。
如果用记事本打开，还可以设置是否统计子目录的；也可以设置统计其它类型的代码！
统计的标准是非回车空行！    

@echo off
:config()
:{
       set count_type=0
       :#  0：表示只统计当前目录
       :#  1：表示只统计当前目录，包括子目录

       set count_ext=.php
       :#  表示统计文件的后缀名称
:}

:main()
:{
       if %count_type%==0 (set count_info=当前目录)
       if %count_type%==1 (set count_info=当前目录，包括子目录)
       echo 代码文件数与行数统计(HonestQiao 2006-5-20 0:14)
       echo 统计方式：%count_info%
       echo 文件后缀：%count_ext%
       set /P PauseKey=开始统计（回车开始，Q退出）
       if "%PauseKey%" == "Q" goto :EOF
       if "%PauseKey%" == "q" goto :EOF
       echo.

       cd "%CD%"
       set counts=0
       set count=0
       set tmp_list=%RANDOM%.tmp
       copy /Y NUL %tmp_list% >nul 2>nul
       if %count_type%==0 (dir/b | findstr "%count_ext%\>" > %tmp_list%)
       if %count_type%==1 (dir/b/s | findstr "%count_ext%\>" > %tmp_list%)
       call :function_files_count %tmp_list%
       echo 文件总数：%counts%
       echo 行数总计：%count%
       del /Q %tmp_list%
       echo.
       set /P PauseKey=回车退出
       @echo on
       @goto :EOF
:}

:function_files_count
:{
       set counts_tmp=0
       for /F %%l in ('type %1') do (call :function_files_add "%%l")
       set /A counts=%counts%+%counts_tmp%
       goto :EOF
:}

:function_files_add
:{
       set /A counts_tmp=%counts_tmp%+1
       call :function_file_count %1
       goto :EOF
:}

:function_file_count
:{
       echo 第%counts_tmp%个文件：%1
       set count_tmp=0
       for /F %%l in ('type %1') do (call :function_file_add %1)
       set /A count=%count%+%count_tmp%
       echo 小计行数：%count_tmp%
       echo.
       goto :EOF       
:}

:function_file_add
:{
       set /A count_tmp=%count_tmp%+1
       goto :EOF
:}