1.SQL Injection(SQL注入) 2.Cross-site scritping(XSS):(跨站点脚本攻击) 3.CSRF:(跨站点伪造请求) 4.Email Header Injection(邮件标头注入) 5.Directory Traversal(目录遍历) 6.exposed error messages(错误信息)