<![CDATA[]]>和转义字符的使用和联系

本文介绍了在XML格式的MyBatis映射文件中处理特殊字符如“>”和“<”的方法,包括使用转义字符和CDATA标记两种方案,并对比了两者的优缺点。

一、转义方法介绍


第一种方法:

用了转义字符把>和<替换掉,然后就没有问题了。例如:

 

SELECT * FROM test WHERE 1 = 1 AND start_date  &lt; = CURRENT_DATE AND

 

end_date >= CURRENT_DATE


常用的转义字符如下:

                     &lt;                

     <

小于号

       &gt;

                     >                  

                     大于号

          &amp;

 &

                     

           &apos;

  ’

                     单引号

           &quot;

                     "

                     双引号

  第二种方法:


因为这个是xml格式的,所以不允许出现类似“>”这样的字符,但是都可以使用


<![CDATA[ ]]>符号进行说明,将此类符号不进行解析你的可以写成这个:

 

mapper文件示例代码


<![CDATA[ when min(starttime)<='12:00' and max(endtime)<='12:00' ]]>  

二、两种方式的说明:


在xml格式的文件中,对于“>”、“<”等符号是作为特殊的符号使用的,所以当我们使用


这些符号的时候,往往不会正常的起作用,反而可能产生了语法错误。


而使用第一种方式需要注意以下几个方面:
 
 
(1)转义序列字符之间不能有空格; 


(2) 转义序列必须以”;”结束; 


(3) 单独出现的”&”不会被认为是转义的开始; 


(4) 区分大小写。 
 
2.使用<![CDATA[ ]]>符号相对于使用转义符方法来说是更加高效的。因为,转义前的字


符也好,转义后的字符也好,都会被xml解析器解析,而使用<![CDATA[ ]]>符号来包含


不被转义的内容,则是xml解析器能够识别该符号为忽略解析的内容。
 
另外,使用<![CDATA[ ]]>符号需要注意以下几个方面:


(1) 此部分不能再包含”]]>”; 


(2) 不允许嵌套使用; 


(3)”]]>”这部分不能包含空格或者换行。
 

三、比较


  最后,说说<![CDATA[]]>和xml转移字符的关系,它们两个看起来是不是感觉功能


重复了? 


  是的,它们的功能就是一样的,只是应用场景和需求有些不同:

 
(1)<![CDATA[]]>不能适用所有情况,转义字符可以; 


(2) 对于短字符串<![CDATA[]]>写起来啰嗦,对于长字符串转义字符写起来可读性差;

 
(3) <![CDATA[]]>表示xml解析器忽略解析,所以更快。



注:对于有人说在mybatis的映射文件中,最好使用第二种方法,我还没有找到相关依


据。如果,各位大神有什么答案,或者什么建议,还请不吝赐教。



<REPORT> <SCANINFO TOOLNAME="XXXX" MAKERS="XXXX" POLICY="XXXX" SCANTASK="" SCANTIME="" FILE_ID=""/> <!-- TOOLNAME="扫描工具名称" MAKERS="工具厂商名称" POLICY="策略版本" SCANTASK="任务名称" SCANTIME="扫描时间" FILE_ID="文件ID(没啥大用处其实)" --> <SCANDATA TYPE="OS"> <HOST IP="192.168.0.100"> <!-- *IP地址: --> <OSTYPE>WINDOWS</OSTYPE> <!-- 操作系统类型:Windows、Linux、.... --> <OSVERSION>Windows Server 2008</OSVERSION> <!-- 操作系统版本:Windows 2008、RedHat 9、.... --> <DATA> <VULNERABLITY> <NAME> <![CDATA[ Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="CVE-2005-1794" CNVD="CNVD-2005-1794" MS="MS07-111" OTHER="xxxx"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号",没有编号可用NONE标识 --> <VULTYPE>缓存区溢出</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、中间件漏洞、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <PORT>3389</PORT> <!-- 端口: --> <RISK>中</RISK> <!-- *风险情况:高、中、低、信息 --> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <!-- 漏洞简述: --> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <!-- *漏洞描述 --> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <!-- *解决方案/整改意见 --> <VALIDATE> <![CDATA[ XXXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> <!-- 参考信息 --> </VULNERABLITY> <VULNERABLITY> <NAME> <![CDATA[ Terminal Services Encryption Level is Medium or Low ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="CVE-2005-1794" CNVD="CNVD-2005-1794" MS="MS07-111" OTHER="xxxx"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>设置不当</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、中间件漏洞、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <PORT>3389</PORT> <RISK>中</RISK> > <SYNOPSIS> <![CDATA[ The remote host is using weak cryptography. ]]> </SYNOPSIS> <DESCRIPTION> <![CDATA[ The remote Terminal Services service is not configured to use strong cryptography.xxxxxxxxxxxxxxxxxxxxx ]]> </DESCRIPTION> <SOLUTION> <![CDATA[ - Change RDP encryption level to one of :xxxxxxxxxxxxxxxxxx ]]> </SOLUTION> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <REFERENCE> <![CDATA[ The terminal services encryption level is set to : ]]> </REFERENCE> </VULNERABLITY> </DATA> </HOST> <HOST IP="102.168.20.20"> <OSTYPE>LINUX</OSTYPE> <OSVERSION>RED HAT 9</OSVERSION> <DATA> <VULNERABLITY> <NAME> <![CDATA[ Microsoft Windows Remote Desktop Protocol Server Man-in-the-Middle Weakness ]]> </NAME> <NO CVE="CVE-2005-1794" CNVD="CNVD-2005-1794" MS="MS07-111" OTHER="xxxx"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>缓存区溢出</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、中间件漏洞、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <PORT>3389</PORT> <RISK>中</RISK> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> </VULNERABLITY> <VULNERABLITY> <NAME> <![CDATA[ Terminal Services Encryption Level is Medium or Low ]]> </NAME> <NO CVE="CVE-2005-1794" CNVD="CNVD-2005-1794" MS="MS07-111" OTHER="xxxx"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>设置不当</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、中间件漏洞、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <PORT>3389</PORT> <RISK>中</RISK> <SYNOPSIS> <![CDATA[ The remote host is using weak cryptography. ]]> </SYNOPSIS> <DESCRIPTION> <![CDATA[ The remote Terminal Services service is not configured to use strong cryptography.xxxxxxxxxxxxxxxxxxxxx ]]> </DESCRIPTION> <SOLUTION> <![CDATA[ - Change RDP encryption level to one of :xxxxxxxxxxxxxxxxxx ]]> </SOLUTION> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <REFERENCE> <![CDATA[ The terminal services encryption level is set to : ]]> </REFERENCE> </VULNERABLITY> </DATA> </HOST> </SCANDATA> <SCANDATA TYPE="DB"> <HOST IP="102.168.20.20"> <PORT>1433</PORT> <DBTYPE>Microsoft SQL Server</DBTYPE> <DBVERSION>Microsoft SQL Server 2008 R2</DBVERSION> <DATA> <VULNERABLITY> <NAME> <![CDATA[ Easily-guessed password ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="NONE" CNVD="NONE" MS="NONE" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>弱口令</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、弱口令、其他等等 --> <RISK>高</RISK> <!-- *风险情况:高、中、低、信息 --> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <!-- 漏洞简述: --> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <!-- *漏洞描述 --> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <!-- *解决方案/整改意见 --> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> <!-- 参考信息 --> </VULNERABLITY> <VULNERABLITY> <NAME> <![CDATA[ Terminal Services Encryption Level is Medium or Low ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="NONE" CNVD="NONE" MS="MS13-112" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>设置不当</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、弱口令、其他等等 --> <RISK>中</RISK> <SYNOPSIS> <![CDATA[ The remote host is using weak cryptography. ]]> </SYNOPSIS> <DESCRIPTION> <![CDATA[ The remote Terminal Services service is not configured to use strong cryptography.xxxxxxxxxxxxxxxxxxxxx ]]> </DESCRIPTION> <SOLUTION> <![CDATA[ - Change RDP encryption level to one of :xxxxxxxxxxxxxxxxxx ]]> </SOLUTION> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ The terminal services encryption level is set to : ]]> </REFERENCE> </VULNERABLITY> </DATA> </HOST> <HOST IP="102.168.100.11"> <PORT>1433</PORT> <DBTYPE>Microsoft SQL Server</DBTYPE> <DBVERSION>Microsoft SQL Server 2008 R2</DBVERSION> <DATA> <VULNERABLITY> <NAME> <![CDATA[ Easily-guessed password ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="NONE" CNVD="NONE" MS="NONE" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>弱口令</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、弱口令、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <RISK>高</RISK> <!-- *风险情况:高、中、低、信息 --> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <!-- 漏洞简述: --> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <!-- *漏洞描述 --> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <!-- *解决方案/整改意见 --> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> <!-- 参考信息 --> </VULNERABLITY> <VULNERABLITY> <NAME> <![CDATA[ Terminal Services Encryption Level is Medium or Low ]]> </NAME> <NO CVE="NONE" CNVD="NONE" MS="MS13-112" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>弱口令</VULTYPE> <!-- 漏洞类型:如缓冲区溢出、设置不当、弱口令、其他等等 --> <CVSS>6.4</CVSS> <!-- 通用漏洞评分: --> <RISK>中</RISK> <SYNOPSIS> <![CDATA[ The remote host is using weak cryptography. ]]> </SYNOPSIS> <DESCRIPTION> <![CDATA[ The remote Terminal Services service is not configured to use strong cryptography.xxxxxxxxxxxxxxxxxxxxx ]]> </DESCRIPTION> <SOLUTION> <![CDATA[ - Change RDP encryption level to one of :xxxxxxxxxxxxxxxxxx ]]> </SOLUTION> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ The terminal services encryption level is set to : ]]> </REFERENCE> </VULNERABLITY> </DATA> </HOST> </SCANDATA> <SCANDATA TYPE="WEB"> <HOST WEB="HTTP:\\WWW.TEST.COM"> <WEBSERVERBANNER>Apache tomcat</WEBSERVERBANNER> <!-- Web Server Banner信息, --> <SERVERVERSION>Microsoft Windows 2008 R2</SERVERVERSION> <!-- 服务器信息 --> <TECHNOLOGIES>JSP</TECHNOLOGIES> <!-- 使用语言 --> <DATA> <VULNERABLITY> <NAME> <![CDATA[ SQL注入漏洞 ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="NONE" CNVD="NONE" MS="NONE" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>注入类</VULTYPE> <!-- 漏洞类型:如注入类、跨站脚本类、信息泄露类、弱口令/默认口令类、系统/服务漏洞类、权限/配置设置不当类、产品漏洞类、其他类 --> <RISK>高</RISK> <!-- *风险情况:高、中、低、信息 --> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <!-- 漏洞简述: --> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <!-- *漏洞描述 --> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <!-- *解决方案/整改意见 --> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> <!-- 参考信息 --> <DETAILS> <URL URL="HTTP:\\WWW.TEST.COM?DETAILS=100"> <!-- *存在漏洞的url --> <TYPE>STRING</TYPE> <!-- 类型(string类型、int类型、search类型、反射性、存储型等等) --> <PARAMETER> <![CDATA[ DETAILS=100' AND '1'='1 ]]> </PARAMETER> <!-- 存在漏洞的参数(可带测试脚本) --> <REQUEST> <![CDATA[ GET /preSysApp/global/js/validate/depends/prototype.js HTTP/1.1 Pragma: no-cache Cache-Control: no-cache ]]> </REQUEST> <!-- 测试发送的request --> <RESPONSE> <!-- 接收的request --> <![CDATA[ xxxxxxxxxxxxxxxxxx ]]> </RESPONSE> </URL> <URL URL="HTTP:\\WWW.TEST.COM?id=120"> <!-- *存在漏洞的url --> <TYPE>INT</TYPE> <!-- 类型(string类型、int类型、search类型、反射性、存储型等等) --> <PARAMETER> <![CDATA[ ID=100 AND 1=1 ]]> </PARAMETER> <!-- 存在漏洞的参数(可带测试脚本) --> <REQUEST> <![CDATA[ GET /preSysApp/global/js/validate/depends/prototype.js HTTP/1.1 Pragma: no-cache Cache-Control: no-cache ]]> </REQUEST> <!-- 测试发送的request --> <RESPONSE> <![CDATA[ xxxxxxxxxxxxxxxxxx ]]> </RESPONSE> <!-- 接收的request --> </URL> </DETAILS> </VULNERABLITY> <VULNERABLITY> <NAME> <![CDATA[ 跨站脚本 ]]> </NAME> <!-- *漏洞名称: --> <NO CVE="NONE" CNVD="NONE" MS="NONE" OTHER="NONE"/> <!-- CVE="CVE编号" CNVD="CNVD编号" MS="微软编号" OTHER="其他编号" --> <VULTYPE>跨站脚本类</VULTYPE> <!-- 漏洞类型:如注入类、跨站脚本类、信息泄露类、弱口令/默认口令类、系统/服务漏洞类、权限/配置设置不当类、产品漏洞类、其他类 --> <RISK>高</RISK> <!-- *风险情况:高、中、低、信息 --> <SYNOPSIS> <![CDATA[ It may be possible to get access to the remote host ]]> </SYNOPSIS> <!-- 漏洞简述: --> <DESCRIPTION> <![CDATA[ The remote version of the Remote Desktop Protocol Server (TerminalService) is vulnerable to a man-in-the-middle (MiTM) attack. The RDP ]]> </DESCRIPTION> <!-- *漏洞描述 --> <SOLUTION> <![CDATA[ - Force the use of SSL as a transport layer for this service if supported, or/and ]]> </SOLUTION> <!-- *解决方案/整改意见 --> <VALIDATE> <![CDATA[ XXXXX ]]> </VALIDATE> <!-- 证据 --> <REFERENCE> <![CDATA[ http://www.oxid.it/downloads/rdp-gbu.pdf ]]> </REFERENCE> <!-- 参考信息 --> <DETAILS> <URL URL="HTTP:\\WWW.TEST.COM?DETAILS=100"> <!-- *存在漏洞的url --> <TYPE>反射性</TYPE> <!-- 类型(string类型、int类型、search类型、反射性、存储型等等) --> <PARAMETER> <![CDATA[ DETAILS=100%20%3C%73%63%72%69%70%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E ]]> </PARAMETER> <!-- 存在漏洞的参数(可带测试脚本) --> <REQUEST> <![CDATA[ GET /preSysApp/global/js/validate/depends/prototype.js HTTP/1.1 Pragma: no-cache Cache-Control: no-cache ]]> </REQUEST> <!-- 测试发送的request --> <RESPONSE> <!-- 接收的request --> <![CDATA[ xxxxxxxxxxxxxxxxxx ]]> </RESPONSE> </URL> </DETAILS> </VULNERABLITY> </DATA> </HOST> </SCANDATA> </REPORT>生成的xml为次格式
最新发布
08-23
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值