解决方法：

1、 进入 xampp安装目录

2、进入mysql\bin\目录， 打开my.ini ， 修改

[mysqld]
port= 3306
socket= “/xampp/mysql/mysql.sock”
basedir=”/xampp/mysql”
tmpdir=”/xampp/tmp”
datadir=”/xampp/mysql/data”

把路径补全，比如xampp安装在d盘根目录，那么修改为

[mysqld]
port= 3306
socket= “d:/xampp/mysql/mysql.sock”
basedir=”d:/xampp/mysql”
tmpdir=”d:/xampp/tmp”
datadir=”d:/xampp/mysql/data”

3、 重启mysql，搞定

Related posts:

1. xampp
2. MYSQL+.NET
3. VPS 快速安装 Linux+Nginx+MySQL+PHP 环境【转】

http://douban.fm/j/mine/playlist?r=0.8999408618547022&type=r&sid=501054&h=|364993:p|630475:p|1380740:p|501054:r&channel=2

SID,CHANNEL,type都是必须的。返回个PLAYLIST。JSON数组?

{“r”:0,”song”:[{"picture":"http:\/\/img3.douban.com\/mpic\/s1400647.jpg","albumtitle":"Lennon Legend: The V...","company":"Capitol","rating_avg":4.609370,"public_time":"1998-02-24","album":"\/subject\/1395275\/","like":"0","artist":"John Lennon","url":"http:\/\/mr4.douban.com\/201101021105\/0222ce7c85ff473e0d91d8d56305e79d\/view\/song\/small\/p1403051.mp3","title":"Cold Turkey","subtype":"","sid":"1403051","aid":"1395275"},{"picture":"http:\/\/img3.douban.com\/mpic\/s3868617.jpg","albumtitle":"Dangerous","company":"Sony","rating_avg":4.696230,"public_time":"1991","album":"\/subject\/1422152\/","like":"0","artist":"Michael Jackson","url":"http:\/\/mr4.douban.com\/201101021105\/20236647acd3ff11c48b284b6817072e\/view\/song\/small\/p967061.mp3","title":"Dangerous","subtype":"","sid":"967061","aid":"1422152"},{"picture":"http:\/\/img3.douban.com\/mpic\/s2717072.jpg","albumtitle":"Westlife - Unbreakab...","company":"RCA Victor Europe","rating_avg":4.496790,"public_time":"2002-11-26","album":"\/subject\/1452987\/","like":"0","artist":"Westlife","url":"http:\/\/mr4.douban.com\/201101021105\/c105dc2839686ef307a4e175bb2170f1\/view\/song\/small\/p1382426.mp3","title":"Unbreakable (single Remix)","subtype":"","sid":"1382426","aid":"1452987"},{"picture":"http:\/\/img3.douban.com\/mpic\/s3017846.jpg","albumtitle":"It Won't Be Soon Bef...","company":"A&M \/ Octone Records","rating_avg":4.088900,"public_time":"2007-05-22","album":"\/subject\/2032823\/","like":"0","artist":"Maroon 5","url":"http:\/\/mr4.douban.com\/201101021105\/c8a3fa06b4c3a5f7236a7f92d74c2243\/view\/song\/small\/p464284.mp3","title":"Won’t Go Home Without You (acoustic Version)","subtype":"","sid":"464284","aid":"2032823"},{"picture":"http:\/\/img3.douban.com\/mpic\/s1400216.jpg","albumtitle":"The Memory Of Trees","company":"© 1995 Warner Music UK Ltd. \/ Reprise Records","rating_avg":4.402740,"public_time":"1995","album":"\/subject\/1394952\/","like":"0","artist":"Enya","url":"http:\/\/mr4.douban.com\/201101021105\/19678cf350c8b131f5e871ad583cd9e7\/view\/song\/small\/p658204.mp3","title":"From Where I Am","subtype":"","sid":"658204","aid":"1394952"},{"picture":"http:\/\/img3.douban.com\/mpic\/s3142014.jpg","albumtitle":"Dreaming Out Loud","company":"Interscope Records","rating_avg":4.162190,"public_time":"2007-11-20","album":"\/subject\/2285684\/","like":"0","artist":"OneRepublic","url":"http:\/\/mr4.douban.com\/201101021105\/dc07f33a38af5d185e66d38af7b5689c\/view\/song\/small\/p1381621.mp3","title":"Stop And Stare","subtype":"","sid":"1381621","aid":"2285684"},{"picture":"http:\/\/img5.douban.com\/mpic\/s3771905.jpg","albumtitle":"Com Lag (2Plus2IsFiv...","company":"EMI Int'l","rating_avg":4.190890,"public_time":"2004","album":"\/subject\/1401429\/","like":"0","artist":"Radiohead","url":"http:\/\/mr3.douban.com\/201101021105\/04367996e2be40270af518cb4d8ec24e\/view\/song\/small\/p1437167.mp3","title":"I Will [Los Angeles Version]“,”subtype”:”",”sid”:”1437167″,”aid”:”1401429″},{“picture”:”http:\/\/img3.douban.com\/mpic\/s3319502.jpg”,”albumtitle”:”Playing My Game”,”company”:”Emi”,”rating_avg”:4.443200,”public_time”:”2000″,”album”:”\/subject\/1416411\/”,”like”:”0″,”artist”:”Lene Marlin”,”url”:”http:\/\/mr4.douban.com\/201101021105\/50e6a293efe3c02f1c3a59a68d08430c\/view\/song\/small\/p1036351.mp3″,”title”:”One Year Ago”,”subtype”:”",”sid”:”1036351″,”aid”:”1416411″}]}

可以很明显的看到评分，命名，歌手，歌名等信息，就是不知道那个/SONG/SMALL，是否有对于的/SONG/BIG

下面这位同学已经写好了啦。可以反编译下。可惜自动保存歌曲那个插件坏链了，无法下载。

不依靠各类SDK的一时无法下手啊，对SDK依赖不小啊，可以顺便学习下BHO，蛮好玩的

http://slippor.blogbus.com/logs/62644175.html?s=info&v=4.4.1227.2&t=W7

最近没什么兴趣点，神马程序都是浮云，各类服务才是王道

Related posts:

1. 推荐1-瞬间之美
2. ROT13

代码：http://code.google.com/p/micolog/source/checkout

简单实用，其主页那篇高性能WEB文章也很强大

于是我也凑热闹搞了个，http://xiaofing.appspot.com/

不过看很多XX站点也在使用MICOLOG，在GG的羽翼下，前景一般。猜测会有名单制度相对应

Related posts:

1. CSS隐藏文字的方法

Planet – Chinahttp://secinn.appspot.com/planet/feed?site=cn 

Related posts:

1. 20开源搜索引擎系统
2. SEO打手
3. 9个PHP库简介和下载

Related posts:

1. ExtJs通过JSON与后台通信
2. asp.net(c#)利用RAR实现文件压缩

1.EnginSite CSS Editor

EnginSite CSS Editor是一个很好的CSS“即时”预览编辑器。此编辑器是开始简

单任务和设计师设计重点的理想工具。

2.CSSEdit

CSSEdit屹立在世界的发展与先进的网络编辑和基本的中间。CSS编辑漂亮和干净。这是最

适合第一次进行CSS编码的人员。

3.Stylizer

Stylizer是一个可视化的CSS代码编辑器。它具有实时预览的功能。它还具有指向和点击界

面，让您的目标通过点击网页元素，使CSS编辑不在话下。 Stylizer仅适用于Windows和

Mac OS。

4.Style Master

Style Master是一个跨平台的CSS开发中的应用，与强大的功能设置，例如自动

完成功能。它还有一个功能叫做支持监视器，警告可能某些浏览器会不兼容的的CSS。

5.RapidCSS

RapidCSS是理想的编写CSS代码，它重量轻，提供了多种功能，如代码自动完成，语法

高亮，内置的CSS参考和标签的CSS各种捷径。

6.Free CSS Toolbox

Free CSS toolbox对CSS是一种简单的文本编辑器。这是非常轻便和易于使用。它有一

个语法高亮显示功能，代码自动完成，CSS验证器和压缩机。

7.CoffeeCup StyleSheet Maker

CoffeeCup StyleSheet Maker是另一个CSS编辑器可以提供许多功能，但缺点是不灵 活。

8.JellyFish-CSS

JellyFish CSS 是一个聪明，简单的CSS编辑器。它有助于编辑CSS代码方便，快捷。

它还将帮助您避开与它的代码感觉功能不一致的CSS语法错误。

9.SnapCSS

SnapCSS只是一个窗口的CSS编辑器，但是非常轻巧，具有一个超级简单的文本编辑器接

口。它有一个美化的代码功能，可以自动格式化和规范你的CSS。

10.SimpleCSS

SimpleCSS是Mac OS的从头轻松地创建样式表的应用。它有一个导入功能

允许您汇集到一个文件中的几个样式。 SimpleCSS还有拖曳重新排序拖放

功能。

No related posts.

1. 函数的任意数目的参数

你可能知道PHP允许你定义一个默认参数的函数。但你可能并不知道PHP还允许你定义一个完全任意的参数的函数

下面是一个示例向你展示了默认参数的函数：

// 两个默认参数的函数
function foo($arg1 = '', $arg2 = '') {

	echo "arg1: $arg1\n";
	echo "arg2: $arg2\n";

}

foo('hello','world');
/* 输出:
arg1: hello
arg2: world
*/

foo();
/* 输出:
arg1:
arg2:
*/

现在我们来看一看一个不定参数的函数，其使用到了?func_get_args()方法：

// 是的，形参列表为空
function foo() {

	// 取得所有的传入参数的数组
	$args = func_get_args();

	foreach ($args as $k => $v) {
		echo "arg".($k+1).": $v\n";
	}

}

foo();
/* 什么也不会输出 */

foo('hello');
/* 输出
arg1: hello
*/

foo('hello', 'world', 'again');
/* 输出
arg1: hello
arg2: world
arg3: again
*/

2. 使用 Glob() 查找文件

很多PHP的函数都有一个比较长的自解释的函数名，但是，当你看到?glob() 的时候，你可能并不知道这个函数是用来干什么的，除非你对它已经很熟悉了。

你可以认为这个函数就好?scandir() 一样，其可以用来查找文件。

// 取得所有的后缀为PHP的文件
$files = glob('*.php');

print_r($files);
/* 输出:
Array
(
    [0] => phptest.php
    [1] => pi.php
    [2] => post_output.php
    [3] => test.php
)
*/

你还可以查找多种后缀名

// 取PHP文件和TXT文件
$files = glob('*.{php,txt}', GLOB_BRACE);

print_r($files);
/* 输出:
Array
(
    [0] => phptest.php
    [1] => pi.php
    [2] => post_output.php
    [3] => test.php
    [4] => log.txt
    [5] => test.txt
)
*/

你还可以加上路径：

$files = glob('../images/a*.jpg');

print_r($files);
/* 输出:
Array
(
    [0] => ../images/apple.jpg
    [1] => ../images/art.jpg
)
*/

如果你想得到绝对路径，你可以调用?realpath() 函数：

$files = glob('../images/a*.jpg');

// applies the function to each array element
$files = array_map('realpath',$files);

print_r($files);
/* output looks like:
Array
(
    [0] => C:\wamp\www\images\apple.jpg
    [1] => C:\wamp\www\images\art.jpg
)
*/

3. 内存使用信息

观察你程序的内存使用能够让你更好的优化你的代码。

PHP 是有垃圾回收机制的，而且有一套很复杂的内存管理机制。你可以知道你的脚本所使用的内存情况。要知道当前内存使用情况，你可以使用?memory_get_usage() 函数，如果你想知道使用内存的峰值，你可以调用memory_get_peak_usage() 函数。

echo "Initial: ".memory_get_usage()." bytes \n";
/* 输出
Initial: 361400 bytes
*/

// 使用内存
for ($i = 0; $i < 100000; $i++) {
	$array []= md5($i);
}

// 删除一半的内存
for ($i = 0; $i < 100000; $i++) {
	unset($array[$i]);
}

echo "Final: ".memory_get_usage()." bytes \n";
/* prints
Final: 885912 bytes
*/

echo "Peak: ".memory_get_peak_usage()." bytes \n";
/* 输出峰值
Peak: 13687072 bytes
*/

4. CPU使用信息

使用?getrusage() 函数可以让你知道CPU的使用情况。注意，这个功能在Windows下不可用。

print_r(getrusage());
/* 输出
Array
(
    [ru_oublock] => 0
    [ru_inblock] => 0
    [ru_msgsnd] => 2
    [ru_msgrcv] => 3
    [ru_maxrss] => 12692
    [ru_ixrss] => 764
    [ru_idrss] => 3864
    [ru_minflt] => 94
    [ru_majflt] => 0
    [ru_nsignals] => 1
    [ru_nvcsw] => 67
    [ru_nivcsw] => 4
    [ru_nswap] => 0
    [ru_utime.tv_usec] => 0
    [ru_utime.tv_sec] => 0
    [ru_stime.tv_usec] => 6269
    [ru_stime.tv_sec] => 0
)

*/

这个结构看上出很晦涩，除非你对CPU很了解。下面一些解释：

• ru_oublock: 块输出操作
• ru_inblock: 块输入操作
• ru_msgsnd: 发送的message
• ru_msgrcv: 收到的message
• ru_maxrss: 最大驻留集大小
• ru_ixrss: 全部共享内存大小
• ru_idrss:全部非共享内存大小
• ru_minflt: 页回收
• ru_majflt: 页失效
• ru_nsignals: 收到的信号
• ru_nvcsw: 主动上下文切换
• ru_nivcsw: 被动上下文切换
• ru_nswap: 交换区
• ru_utime.tv_usec: 用户态时间 (microseconds)
• ru_utime.tv_sec: 用户态时间(seconds)
• ru_stime.tv_usec: 系统内核时间 (microseconds)
• ru_stime.tv_sec: 系统内核时间?(seconds)

要看到你的脚本消耗了多少CPU，我们需要看看“用户态的时间”和“系统内核时间”的值。秒和微秒部分是分别提供的，您可以把微秒值除以100万，并把它添加到秒的值后，可以得到有小数部分的秒数。

// sleep for 3 seconds (non-busy)
sleep(3);

$data = getrusage();
echo "User time: ".
	($data['ru_utime.tv_sec'] +
	$data['ru_utime.tv_usec'] / 1000000);
echo "System time: ".
	($data['ru_stime.tv_sec'] +
	$data['ru_stime.tv_usec'] / 1000000);

/* 输出
User time: 0.011552
System time: 0
*/

sleep是不占用系统时间的，我们可以来看下面的一个例子：

// loop 10 million times (busy)
for($i=0;$i<10000000;$i++) {

}

$data = getrusage();
echo "User time: ".
	($data['ru_utime.tv_sec'] +
	$data['ru_utime.tv_usec'] / 1000000);
echo "System time: ".
	($data['ru_stime.tv_sec'] +
	$data['ru_stime.tv_usec'] / 1000000);

/* 输出
User time: 1.424592
System time: 0.004204
*/

这花了大约14秒的CPU时间，几乎所有的都是用户的时间，因为没有系统调用。

系统时间是CPU花费在系统调用上的上执行内核指令的时间。下面是一个例子：

$start = microtime(true);
// keep calling microtime for about 3 seconds
while(microtime(true) - $start < 3) {

}

$data = getrusage();
echo "User time: ".
	($data['ru_utime.tv_sec'] +
	$data['ru_utime.tv_usec'] / 1000000);
echo "System time: ".
	($data['ru_stime.tv_sec'] +
	$data['ru_stime.tv_usec'] / 1000000);

/* prints
User time: 1.088171
System time: 1.675315
*/

我们可以看到上面这个例子更耗CPU。

5. 系统常量

PHP 提供非常有用的系统常量 可以让你得到当前的行号 (__LINE__)，文件 (__FILE__)，目录 (__DIR__)，函数名 (__FUNCTION__)，类名(__CLASS__)，方法名(__METHOD__) 和名字空间 (__NAMESPACE__)，很像C语言。

我们可以以为这些东西主要是用于调试，当也不一定，比如我们可以在include其它文件的时候使用?__FILE__ (当然，你也可以在 PHP 5.3以后使用 __DIR__ )，下面是一个例子。

// this is relative to the loaded script's path
// it may cause problems when running scripts from different directories
require_once('config/database.php');

// this is always relative to this file's path
// no matter where it was included from
require_once(dirname(__FILE__) . '/config/database.php');

下面是使用 __LINE__ 来输出一些debug的信息，这样有助于你调试程序：

// some code
// ...
my_debug("some debug message", __LINE__);
/* 输出
Line 4: some debug message
*/

// some more code
// ...
my_debug("another debug message", __LINE__);
/* 输出
Line 11: another debug message
*/

function my_debug($msg, $line) {
	echo "Line $line: $msg\n";
}

6.生成唯一的ID

有很多人使用 md5() 来生成一个唯一的ID，如下所示：

// generate unique string
echo md5(time() . mt_rand(1,1000000));

其实，PHP中有一个叫?uniqid() 的函数是专门用来干这个的：

// generate unique string
echo uniqid();
/* 输出
4bd67c947233e
*/

// generate another unique string
echo uniqid();
/* 输出
4bd67c9472340
*/

可能你会注意到生成出来的ID前几位是一样的，这是因为生成器依赖于系统的时间，这其实是一个非常不错的功能，因为你是很容易为你的这些ID排序的。这点MD5是做不到的。

你还可以加上前缀避免重名：

// 前缀
echo uniqid('foo_');
/* 输出
foo_4bd67d6cd8b8f
*/

// 有更多的熵
echo uniqid('',true);
/* 输出
4bd67d6cd8b926.12135106
*/

// 都有
echo uniqid('bar_',true);
/* 输出
bar_4bd67da367b650.43684647
*/

而且，生成出来的ID会比MD5生成的要短，这会让你节省很多空间。

7. 序列化

你是否会把一个比较复杂的数据结构存到数据库或是文件中？你并不需要自己去写自己的算法。PHP早已为你做好了，其提供了两个函数：?serialize() 和 unserialize():

// 一个复杂的数组
$myvar = array(
	'hello',
	42,
	array(1,'two'),
	'apple'
);

// 序列化
$string = serialize($myvar);

echo $string;
/* 输出
a:4:{i:0;s:5:"hello";i:1;i:42;i:2;a:2:{i:0;i:1;i:1;s:3:"two";}i:3;s:5:"apple";}
*/

// 反序例化
$newvar = unserialize($string);

print_r($newvar);
/* 输出
Array
(
    [0] => hello
    [1] => 42
    [2] => Array
        (
            [0] => 1
            [1] => two
        )

    [3] => apple
)
*/

这是PHP的原生函数，然而在今天JSON越来越流行，所以在PHP5.2以后，PHP开始支持JSON，你可以使用 json_encode() 和 json_decode() 函数

// a complex array
$myvar = array(
	'hello',
	42,
	array(1,'two'),
	'apple'
);

// convert to a string
$string = json_encode($myvar);

echo $string;
/* prints
["hello",42,[1,"two"],"apple"]
*/

// you can reproduce the original variable
$newvar = json_decode($string);

print_r($newvar);
/* prints
Array
(
    [0] => hello
    [1] => 42
    [2] => Array
        (
            [0] => 1
            [1] => two
        )

    [3] => apple
)
*/

这看起来更为紧凑一些了，而且还兼容于Javascript和其它语言。但是对于一些非常复杂的数据结构，可能会造成数据丢失。

8. 字符串压缩

当我们说到压缩，我们可能会想到文件压缩，其实，字符串也是可以压缩的。PHP提供了?gzcompress() 和 gzuncompress() 函数：

$string =
"Lorem ipsum dolor sit amet, consectetur
adipiscing elit. Nunc ut elit id mi ultricies
adipiscing. Nulla facilisi. Praesent pulvinar,
sapien vel feugiat vestibulum, nulla dui pretium orci,
non ultricies elit lacus quis ante. Lorem ipsum dolor
sit amet, consectetur adipiscing elit. Aliquam
pretium ullamcorper urna quis iaculis. Etiam ac massa
sed turpis tempor luctus. Curabitur sed nibh eu elit
mollis congue. Praesent ipsum diam, consectetur vitae
ornare a, aliquam a nunc. In id magna pellentesque
tellus posuere adipiscing. Sed non mi metus, at lacinia
augue. Sed magna nisi, ornare in mollis in, mollis
sed nunc. Etiam at justo in leo congue mollis.
Nullam in neque eget metus hendrerit scelerisque
eu non enim. Ut malesuada lacus eu nulla bibendum
id euismod urna sodales. ";

$compressed = gzcompress($string);

echo "Original size: ". strlen($string)."\n";
/* 输出原始大小
Original size: 800
*/

echo "Compressed size: ". strlen($compressed)."\n";
/* 输出压缩后的大小
Compressed size: 418
*/

// 解压缩
$original = gzuncompress($compressed);

几乎有50% 压缩比率。同时，你还可以使用?gzencode() 和 gzdecode() 函数来压缩，只不用其用了不同的压缩算法。

9. 注册停止函数

有一个函数叫做?register_shutdown_function()，可以让你在整个脚本停时前运行代码。让我们看下面的一个示例：

// capture the start time
$start_time = microtime(true);

// do some stuff
// ...

// display how long the script took
echo "execution took: ".
		(microtime(true) - $start_time).
		" seconds.";

上面这个示例只不过是用来计算某个函数运行的时间。然后，如果你在函数中间调用?exit() 函数，那么你的最后的代码将不会被运行到。并且，如果该脚本在浏览器终止（用户按停止按钮），其也无法被运行。

而当我们使用了register_shutdown_function()后，你的程序就算是在脚本被停止后也会被运行：

$start_time = microtime(true);

register_shutdown_function('my_shutdown');

// do some stuff
// ...

function my_shutdown() {
	global $start_time;

	echo "execution took: ".
			(microtime(true) - $start_time).
			" seconds.";
}

Related posts:

1. 21个21个实用PHP代码
2. 26JQUERY-SKILLS
3. php编写易范错误

The CRLF Injection Attack (sometimes also referred to as HTTP Response Splitting) is a fairly simple, yet extremely powerful web attack.  Hackers are actively exploiting this web application vulnerability to perform a large variety of attacks that include XSS cross-site scripting, cross-user defacement, positioning of client’s web-cache, hijacking of web pages, defacement and a myriad of other related attacks.  A number of years ago a number of CRLF injection vulnerabilities were also discovered in Google’s Adwords web interface.
 
Sounds scary to you? You bet. Are you vulnerable? Quite possibly, and this is why.

CRLF Injection Mechanism

CRLF (Carriage Return and Line Feed) is a very significant sequence of characters for programmers. These two special characters represent the End Of Header marker (EOH) for many Internet protocols, including, but not limited to MIME (e-mail), NTTP (newsgroups) and more importantly HTTP.  When programmers write code for web applications they split headers based on where the CRLF is found. If a malicious user is able to inject his own CRLF sequence into an HTTP stream, he is able to maliciously control the way a web application functions.

A simple CRLF Injection example

Suppose you run a vulnerable website that has a member section. An attacker will send an email to one of your members containing a CRLF-crafted link. This link appears to be legitimate; after all it points to your own website.  The link might look something like the one below:

http://www.yoursite.com/somepage.php?page=%0d%0aContent-Type: text/html%0d%0aHTTP/1.1 200 OK%0d%0aContent-Type: text/html%0d%0a%0d%0a%3Chtml%3EHacker Content%3C/html%3E

When the victim clicks on the link he will be served with the following HTML page:
 
<html>Hacker Content</html>

This attack appears to simply show the words “Hacker Content” on the victim’s machine however the danger is that YOUR server has generated this HTML code, so effectively the hacker has injected HTML code into the victims browser via YOUR web server! Ouch.  More sophisticated variations of this example can lead to poisioning of the client’s web-cache, cookies, XSS, temporary or permanent defacement of web pages and even information theft.

Example insight

If you look closely at the malicious URL you might notice a few occurences of the pattern %0d%0a. This pattern is the HTTP equivalent of CRLF and is the reason why we call this technique it a CRLF Injection Attack.

Known countermeasures

The only effective countermeasure is to properly sanitize URLs that point to web pages on your site containing any server re-direction code. Finding these holes is not a trivial task; most web applications today are littered with server-side redirects so the location of these vulnerabilities is not always clear, and it is very easy to miss most of them. Normally it can take hundreds of man-hours to test all your web page redirects and therefore it is very common to use an automated tool such as a web vulnerability scanner to find such web vulnerabilities.

Check if your website is vulnerable to CRLF injection

Acunetix Web Vulnerability Scanner ensures website security by automatically checking for CRLF Injection, SQL injection, Cross site scripting attacks and other vulnerabilities. It checks password strength on authentication pages and automatically audits shopping carts, forms, dynamic content and other web applications. As the scan is being completed, the software produces detailed reports that pinpoint where vulnerabilities exist. Take a product tour or download the evaluation version today!

Scanning for XSS vulnerabilities with Acunetix WVS Free Edition!

To check whether your website has cross site scripting vulnerabilities, download the Free Edition from here. This version will scan any website / web application for XSS vulnerabilities and it will also reveal all the essential information related to it, such as the vulnerability location and remediation techniques. Scanning for XSS is normally a quick exercise (depending on the size of the web-site).

Related posts:

1. WAR3格式
2. How to: Create and use WordPress page templates
3. Top Ten Web Hacking Techniques of 2009!

using System;
using System.Text;
using System.IO;
using System.Globalization;
using System.Security.Cryptography;</code>// 创建Key
public string GenerateKey()
{
DESCryptoServiceProvider desCrypto = (DESCryptoServiceProvider)DESCryptoServiceProvider.Create();
return ASCIIEncoding.ASCII.GetString(desCrypto.Key);
}
// 加密字符串
public string EncryptString(string sInputString, string sKey)
{
byte [] data = Encoding.UTF8.GetBytes(sInputString);
DESCryptoServiceProvider md5 = new DESCryptoServiceProvider();
md5.Key = ASCIIEncoding.ASCII.GetBytes(sKey);

namespace MyFileBrowser
{
public class MD5
{
///MD5加密
public string MD5Encrypt(string pToEncrypt, string sKey)
{
DESCryptoServiceProvider md5 = new DESCryptoServiceProvider();
byte[] inputByteArray = Encoding.Default.GetBytes(pToEncrypt);
md5.Key = ASCIIEncoding.ASCII.GetBytes(sKey);
md5.IV = ASCIIEncoding.ASCII.GetBytes(sKey);
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms, md5.CreateEncryptor(), CryptoStreamMode.Write);
cs.Write(inputByteArray, 0, inputByteArray.Length);
cs.FlushFinalBlock();
StringBuilder ret = new StringBuilder();
foreach (byte b in ms.ToArray())
{
ret.AppendFormat("{0:X2}", b);
}
ret.ToString();
return ret.ToString();
}

///MD5解密
public string MD5Decrypt(string pToDecrypt, string sKey)
{
DESCryptoServiceProvider md5 = new DESCryptoServiceProvider();

byte[] inputByteArray = new byte[pToDecrypt.Length / 2];
for (int x = 0; x &lt; pToDecrypt.Length / 2; x++)
{
int i = (Convert.ToInt32(pToDecrypt.Substring(x * 2, 2), 16));
inputByteArray[x] = (byte)i;
}

md5.Key = ASCIIEncoding.ASCII.GetBytes(sKey);
md5.IV = ASCIIEncoding.ASCII.GetBytes(sKey);
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms, md5.CreateDecryptor(), CryptoStreamMode.Write);
cs.Write(inputByteArray, 0, inputByteArray.Length);
cs.FlushFinalBlock();

StringBuilder ret = new StringBuilder();

return System.Text.Encoding.Default.GetString(ms.ToArray());
}

md5.IV = ASCIIEncoding.ASCII.GetBytes(sKey);
ICryptoTransform desencrypt = md5.CreateEncryptor();
byte [] result = desencrypt.TransformFinalBlock(data, 0, data.Length);
return BitConverter.ToString(result);
}
// 解密字符串
public string DecryptString(string sInputString, string sKey)
{
string [] sInput = sInputString.Split("-".ToCharArray());
byte [] data = new byte[sInput.Length];
for(int i = 0; i &lt; sInput.Length; i++)
{
data[i] = byte.Parse(sInput[i], NumberStyles.HexNumber);
}
DESCryptoServiceProvider md5 = new DESCryptoServiceProvider();
md5.Key = ASCIIEncoding.ASCII.GetBytes(sKey);
md5.IV = ASCIIEncoding.ASCII.GetBytes(sKey);
ICryptoTransform desencrypt = md5.CreateDecryptor();
byte [] result = desencrypt.TransformFinalBlock(data, 0, data.Length);
return Encoding.UTF8.GetString(result);
}
}
    /*
  class Test
{
    static void Main()
    {
        bool sy = true;
        char a;
        MD5 md5 = new MD5();
        string key = md5.GenerateKey();
        string s0 = " microsoft ";
        string s1 = md5.EncryptString(s0, key);
        string s2 = md5.DecryptString(s1, key);
        Console.WriteLine("原串: [{0}]", s0);
        Console.WriteLine("加密: [{0}]", s1);
        Console.WriteLine("解密: [{0}]", s2);
        while (sy)
        {
            Console.WriteLine("是否输入字符串？ Y/N");
            a = Convert.ToChar(Console.ReadLine());
            if ( a == 'Y' || a == 'y')
            {
                sy = true;
                Console.WriteLine(" 请输入所要验证的字符串 ");
                s0 = Console.ReadLine();
                s1 = md5.EncryptString(s0, key);
                s2 = md5.DecryptString(s1, key);
                Console.WriteLine("原串: [{0}]", s0);
                Console.WriteLine("加密: [{0}]", s1);
                Console.WriteLine("解密: [{0}]", s2);
            }
            else
                if (a == 'N' || a == 'n')
                    sy = false;
                else
                    Console.WriteLine(" 您一定输错了，请重新输入 ！");
        }
    }
}
    */
}

被我注销掉的是错误引用，悲剧就从这开始了，他调用了的是子函数，于是我试着在BYTE[]和STRING之间做各种转换，搞完了发现我就是把原函数简略的写了遍，下面是MSDN的例子和一些

<span style="COLOR: blue">byte</span>[] bytes = { 0, 1, 14, 168, 255 };
<span style="COLOR: blue">foreach</span> (<span style="COLOR: blue">byte</span> byteValue <span style="COLOR: blue">in</span> bytes)
   outputBlock.Text += byteValue + <span style="COLOR: #a31515">"\n"</span>;
<span style="COLOR: green">// The example displays the following output if the current</span>
<span style="COLOR: green">// culture is en-US:</span>
<span style="COLOR: green">//       0</span>
<span style="COLOR: green">//       1</span>
<span style="COLOR: green">//       14</span>
<span style="COLOR: green">//       168</span>
<span style="COLOR: green">//       255</span>

 #region BYTE转换STRING
      /*  static char[] hexDigits = {
        '0', '1', '2', '3', '4', '5', '6', '7',
        '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'};

        public static string ToHexString(byte[] bytes)
        {
            char[] chars = new char[bytes.Length * 2];
            for (int i = 0; i &lt; bytes.Length; i++)
            {
                int b = bytes[i];
                chars[i * 2] = hexDigits[b &gt;&gt; 4];
                chars[i * 2 + 1] = hexDigits[b &amp; 0xF];
            }
            return new string(chars);
        }*/
        #endregion

-----------------------------------------------------------------------------------------

最后上我的最终代码：

  #region 修改密码
        public void changepsw()
        {
            MD5 md6 = new MD5();
         // readoutkey = md5.GenerateKey();//调用产生函数
 //byte[] mykey = System.Text.Encoding.UTF8.GetBytes(readoutkey);
 //string finkey = ToHexString(mykey); //MD5公匙转换成HEXstring形式方便保存
  byte[] chang = HexToByte(readoutkey);//读出的HEXstring格式转换成BYTE
 string changs = System.Text.Encoding.Default.GetString(chang);// 转换成密匙格式
// password = md6.MD5Encrypt("123456", changs);

           temp  = md6.MD5Decrypt(password,changs);
            if (string.Compare(_txtInfo.Text,temp, true) == 0)
            {
                AboutBox1 MyDialog = new AboutBox1();
                MyDialog.Text = "输入密码";
                if (MyDialog.ShowDialog() == DialogResult.OK)
                {
                    MessageBox.Show("您输入的值是：" + MyDialog.textBox1.Text, "信息提示", MessageBoxButtons.OK, MessageBoxIcon.Information);
                    password = MyDialog.textBox1.Text;
                    password = md6.MD5Encrypt(password,changs);
                    byte[] tem = System.Text.Encoding.UTF8.GetBytes(password);
                    string finpass= ToHexString(tem);
                    ConfigAppSettings.SetValue("DemoKey", finpass);
                   // ConfigAppSettings.SetValue("stry",readoutkey);已有密匙
                }
                else
                {
                    MessageBox.Show("操作被取消", "信息提示", MessageBoxButtons.OK, MessageBoxIcon.Information);
                }
                MyDialog.Dispose();
            }
            else MessageBox.Show("在下面文本框中输入正确密码");
          
        }
        #endregion<php>

整个SLN，VS2010U版的

http://cq-cser.cn/wp-content/plugins/downloads-manager/upload/MyFileBrowser.rar

Related posts:

1. ASP.NET加密Cookies
2. app.config-c#读写类
3. DES加密解密函数 收藏 c#

byte[] byteArray = System.Text.Encoding.Default.GetBytes ( str );

反过来，byte[]转成string：

string str = System.Text.Encoding.Default.GetString ( byteArray );

其它编码方式的，如System.Text.UTF8Encoding，System.Text.UnicodeEncoding class等；例如：

string类型转成ASCII byte[]：（”01″ 转成 byte[] = new byte[]{ 0×30, 0×31}）

 byte[] byteArray = System.Text.Encoding.ASCII.GetBytes ( str );

ASCII byte[] 转成string：（byte[] = new byte[]{ 0×30, 0×31} 转成 “01″）

string str = System.Text.Encoding.ASCII.GetString ( byteArray );

有时候还有这样一些需求：

byte[] 转成原16进制格式的string，例如0xae00cf, 转换成 “ae00cf”；new byte[]{ 0×30, 0×31}转成”3031″:

   public static string ToHexString(byte[] bytes) // 0xae00cf => “AE00CF ”
        {
            string hexString = string.Empty;
            if (bytes != null)
            {
                StringBuilder strB = new StringBuilder();

                for (int i = 0; i < bytes.Length; i++)
                {
                    strB.Append(bytes[i].ToString(“X2″));
                }
                hexString = strB.ToString();
            }
            return hexString;
        }

反过来，16进制格式的string 转成byte[]，例如, “ae00cf”转换成0xae00cf，长度缩减一半；“3031″ 转成new byte[]{ 0×30, 0×31}:

private static byte[] HexToByte(string hexString)
        {
            byte[] returnBytes = new byte[hexString.Length / 2];
            for (int i = 0; i < returnBytes.Length; i++)
                returnBytes[i] = Convert.ToByte(hexString.Substring(i * 2, 2), 16);
            return returnBytes;
        }

—————————————————–邪恶的分割线————————————————————

public static byte[] GetBytes(string hexString, out int discarded)
        {
            discarded = 0;
            string newString = “”;
            char c;
            // remove all none A-F, 0-9, characters
            for (int i=0; i<hexString.Length; i++)
            {
                c = hexString[i];
                if (IsHexDigit(c))
                    newString += c;
                else
                    discarded++;
            }
            // if odd number of characters, discard last character
            if (newString.Length % 2 != 0)
            {
                discarded++;
                newString = newString.Substring(0, newString.Length-1);
            }

            int byteLength = newString.Length / 2;
            byte[] bytes = new byte[byteLength];
            string hex;
            int j = 0;
            for (int i=0; i<bytes.Length; i++)
            {
                hex = new String(new Char[] {newString[j], newString[j+1]});
                bytes[i] = HexToByte(hex);
                j = j+2;
            }
            return bytes;
        }

Related posts:

1. DES加密解密函数 收藏 c#
2. 随笔-MD5悲剧-c#
3. ASP.NET加密Cookies