中文摘要：

针对各种动态Web技术的应用和发展加剧了Web应用注入式恶意攻击防范难度的问题,围绕Web应用典型的SQL注入和XSS注入漏洞,综述了近年来提出的、适用于Web应用注入式漏洞检测的研究进展.介绍了Web应用常见的注入式安全漏洞的分类,总结了这类漏洞的成因,梳理了安全漏洞检测的复杂性;阐述了注入式安全漏洞检测的关键技术,包括漏洞注入点的分析和识别、符号执行和污点分析以及基于软件分析和测试模型的漏洞检测方法;最后给出了研究展望.

英文摘要：

To overcome the difficulties of prevention Web applications to be maliciously injected which are increased by all kinds of dynamic Web technologies applied,centered on SQL and XSS injection,the research progresses of Web application injection vulnerabilities detection in recent years were reviewed. Firstly, the classification and causes of the Web application injection security vulnerabilities were summarized; Then,the complexity of security vulnerabilities detection was analyzed; Thirdly,the key technologies of the existing detection approached, including analyzing and identifying the injection points,injection delectations by software analysis and testing,by symbolic execution,by taint analysis and models were elaborated; Finally,its future development direction was presented.