Xuite 的 SQL 指令洩漏

除了少數那幾家走出國際的軟體公司外, 也難怪台灣的軟體業成不了氣候, 再大的網站後面支撐著的程式人員到底是用甚麼樣的測試方法/測試工具??不是說有很多人都去弄了軟體品質管理的認證了嗎??

剛剛逛 Xuite 的時候點了一個連結, 看到的是半正常的畫面, 因為畫面上還包含了一段 SQL 指令… 不曉得是甚麼程式錯誤造成的, 以此為記！

http://photolog.fetag.org/album01/xuite_err1

select id,blog_id,title from article where blog_id='246780' and complete_flag='Y' and display_level='0' and ctime < '2006-03-21 15:56:16' and ctime < '2006-04-06 21:53:45' order by ctime desc  select id,blog_id,title from article where blog_id='246780' and complete_flag='Y' and display_level='0' and ctime > '2006-03-21 15:56:16' and ctime < '2006-04-06 21:53:45' order by ctime asc  select id,blog_id,title from article where blog_id='246780' and complete_flag='Y' and display_level='0' and ctime < '2006-03-21 15:56:16' and ctime < '2006-04-06 21:53:45' order by ctime desc  select id,blog_id,title from article where blog_id='246780' and complete_flag='Y' and display_level='0' and ctime > '2006-03-21 15:56:16' and ctime < '2006-04-06 21:53:45' order by ctime asc   select * from article_track where blog_id='246780' and article_id='5614327' order by ctime desc