对于Web应用来说，注射式攻击由来已久，攻击方式也五花八门，常见的攻击方式有SQL注射、命令注射以及新近才出现的XPath注射等等。本文将以SQL注射为例，在源码级对其攻击原理进行深入的讲解。-Web application injection attacks for a long time, the attack also varied, common SQL injection attacks, to command injection as well as new XPath injection, and so on. In this paper, SQL injection, for example, in-depth explanation of the level in the source code of its attack principle.