refactor(topics): 멀티 에이전트용 지식 재편 — _Common(공통 기본기) + Domain_* 구조

에이전트 8종(대화형/프로그래머 C·S/디자이너/설계자/기획자/QA/PD/PM)에게 [공통 기본 능력 + 롤별 Specialty] 2층으로 지식을 주입하기 위한 재분류. 문서 내용·포맷은 무수정, 폴더 이동만 (6,372개 문서 수 보존 확인). - Topic_Programming → Domain_Programming (내부 구조 보존) - Topic_Graphic → Domain_Design - Topic_Business → Domain_Product - Topic_General → Domain_General - _Common 신설: Math(구 Topic_Math_Specialty), Reasoning(구 General/From_Thinking & Reasoning), Reasoning_Creativity(구 General/From_창의성), Communication(Poetic_Blog_Writing + From_writing) - 타 도메인의 From_* 폴더는 유지 (출처 표기일 뿐, 이미 도메인에 맞게 분류된 문서) - 빈 폴더 정리 (memory/procedures) - 에이전트→폴더 매핑은 workspace의 .astra/agent-knowledge-map.json (9개 에이전트) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 11:05:56 +09:00
parent 6549ead309
commit c24165b8bc
6193 changed files with 1717 additions and 31 deletions
@@ -0,0 +1,73 @@
+---
+id: sql-injection
+title: "SQL Injection"
+category: "Database"
+status: "draft"
+verification_status: "conceptual"
+canonical_id: ""
+aliases: ["SQL 인젝션"]
+duplicate_of: ""
+source_trust_level: "B"
+confidence_score: 0.87
+created_at: 2026-07-04
+updated_at: 2026-07-04
+review_reason: ""
+merge_history: []
+tags: ["sql", "database", "w3schools", "security", "injection"]
+raw_sources: ["https://www.w3schools.com/sql/sql_injection.asp"]
+applied_in: []
+github_commit: ""
+---
+
+# [[SQL Injection]]
+
+## 🎯 한 줄 통찰 (One-line insight)
+SQL injection exploits raw string concatenation of user input into a query — a tautology like `OR 1=1` or a batched `; DROP TABLE ...` can turn a single-row lookup into a full-table dump or destructive command. [S1]
+
+## 🧠 핵심 개념 (Core concepts)
+- **SQL injection** — a code injection technique where attackers insert malicious SQL into user-input fields to read, modify, or delete sensitive data. [S1]
+- **Root cause** — building SQL strings by concatenating raw user input, e.g. `txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;`. [S1]
+- **Tautology injection (`1=1`)** — input like `105 OR 1=1` makes the WHERE clause always true, returning every row. [S1]
+- **Tautology injection (`""=""`)** — the same idea applied to string-quoted login fields (`" OR ""="`), bypassing username/password checks entirely. [S1]
+- **Batched statement injection** — a semicolon lets an attacker append an entirely separate destructive statement, e.g. `UserId = 105; DROP TABLE Suppliers;`. [S1]
+
+## 🧩 추출된 패턴 (Extracted patterns)
+- **Never trust concatenated input** — every example in the source traces back to the same root cause: building a SQL string by directly concatenating unescaped, unvalidated user input. [S1]
+- **The fix lives in the next two chapters** — the source explicitly defers the mitigation (SQL Parameters, SQL Prepared Statements) rather than covering it here. [S1]
+
+## 📖 세부 내용 (Details)
+- Vulnerable pattern: `txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;`. [S1]
+- Tautology exploit: input `105 OR 1=1` yields `SELECT * FROM Users WHERE UserId = 105 OR 1=1;`, returning ALL rows. [S1]
+- Login bypass exploit: input `" OR ""="` on both fields yields `SELECT * FROM Users WHERE Name ="" or ""="" AND Pass ="" or ""=""`, which is always true. [S1]
+- Batched destructive exploit: `SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers;`. [S1]
+
+## ⚖️ 모순 및 업데이트 (Contradictions & updates)
+소스에서 모순되는 정보는 발견되지 않음.
+
+## 🛠️ 적용 사례 (Applied in summary)
+현재 발견된 실제 적용 사례가 없습니다 — 다음 두 챕터(SQL Parameters, SQL Prepared Statements)가 이 문제의 실제 해결책을 제시한다. [S1]
+
+## 💻 코드 패턴 (Code patterns)
+Vulnerable string-concatenation pattern (illustrative, NOT recommended):
+```
+txtUserId = getRequestString("UserId");
+txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;
+```
+
+## ✅ 검증 상태 및 신뢰도
+- **상태:** draft
+- **검증 단계:** conceptual
+- **출처 신뢰도:** B (W3Schools — widely used educational reference, not a primary standards body)
+- **신뢰 점수:** 0.87
+- **중복 검사 결과:** 신규 생성 (New discovery)
+
+## 🔗 지식 그래프 (Knowledge Graph)
+- **상위/루트:** [[SQL Tutorial]]
+- **관련 개념:** [[SQL Parameters]], [[SQL Prepared Statements]]
+- **참조 맥락:** 사용자 입력을 다루는 모든 쿼리 작성 전 반드시 인지해야 할 보안 위협 — 해결책은 다음 두 챕터.
+
+## 📚 출처 (Sources)
+- [S1] W3Schools — SQL Injection — https://www.w3schools.com/sql/sql_injection.asp
+
+## 📝 변경 이력 (Change history)
+- 2026-07-04: Initial draft synthesized from the W3Schools "SQL Injection" page (Astra wiki-curation, P-Reinforce v3.1 format).