有效的电子邮件地址

有效的电子邮件地址 - XSS和SQL注入(Valid Email Addresses - XSS and SQL Injection)

由于电子邮件地址的有效字符太多，是否有任何有效的电子邮件地址本身可能是XSS攻击或SQL注入？ 我在网上找不到关于此的任何信息。

电子邮件地址的本地部分可以使用以下任何ASCII字符：

大写和小写英文字母（a-z，A-Z） 数字0到9 人物！ ＃$％＆'* + - / =？ ^ _`{| }〜 性格。 （点，句号，句号），前提是它不是最后一个字符，并且规定它不会连续出现两次或更多次（例如John..Doe @ example.com）。

http://en.wikipedia.org/wiki/E-mail_address#RFC_specification

我并没有问如何防止这些攻击 （我已经在使用参数化查询和转义/ HTML净化器），这更像是一个概念验证。

首先想到的是'OR 1=1--@gmail.com ，除了空格不允许。 所有SQL注入都需要空格吗？

Since there are so many valid characters for email addresses, are there any valid email addresses that can in themselves be XSS attacks or SQL injections? I couldn't find any information on this on the web.

The local-part of the e-mail address may use any of these ASCII characters:

Uppercase and lowercase English letters (a–z, A–Z) Digits 0 to 9 Characters ! # $ % & ' * + - / = ? ^ _ ` { | } ~ Character . (dot, period, full stop) provided that it is not the last character, and provided also that it does not appear two or more times consecutively (e.g. John..Doe@example.com).

http://en.wikipedia.org/wiki/E-mail_address#RFC_specification

I'm not asking how to prevent these attacks (I'm already using parametrized queries and escaping/HTML purifier), this is more a proof-of-concept.

The first thing that came to mind was 'OR 1=1--@gmail.com, except that spaces are not allowed. Do all SQL injections require spaces?

最满意答案

如果将空格用引号引起来，则空格是允许的，因此， "'OR 1=1--"@gmail.com是有效的电子邮件地址。 此外，这可能不是一个问题，但从技术上讲，这些都是有效的电子邮件地址：

' BAD SQL STUFF -- <fake@ryanbrunner.com> fake@ryanbrunner.com (' BAD SQL STUFF --)

即使这是不可能的，仍然没有理由不应该使用参数化查询并编码显示给用户的所有用户输入数据。

Spaces are allowed if they are enclosed in quotes, however, so "'OR 1=1--"@gmail.com is a valid e-mail address. Also, it's probably less of a concern, but technically speaking, these are both valid e-mail addresses:

' BAD SQL STUFF -- <fake@ryanbrunner.com> fake@ryanbrunner.com (' BAD SQL STUFF --)

Even if this wasn't possible, there's still no reason that you shouldn't be using paramaterized queries and encoding all user-inputted data displayed to users.