网站可以有哪些测试点？
我是一个网站的新手测试员。这个网站的后端是几个SQL Server数据库。 UI 是使用 Ajax 和 ASP.NET 构建的。整个站点托管在 Windows Server 2008 上。该站点的结构如下：多个 IIS Web 应用程序与核心 WCF Web 服务交互。此 WCF Web 服务也是一个 IIS Web 应用程序。
现在我作为客户已经熟悉了该网站的工作流程。这很简单。只需在按钮上点击几下鼠标即可。但我的导师告诉我，在这个“简单的点击”过程中，有很多测试点。那么它们可能是什么？
另外，由于我对此完全陌生，任何人都可以给我关于我可以测试该网站的哪些方面的建议吗？喜欢功能吗？安全？表现？等等。 （越详细越好。）
更新
看来我还不太习惯作为测试人员思考。所以我将非常感谢任何可以帮助我重新格式化我的大脑的见解〜:)
非常感谢。
（另外，我要感谢所以我不知道还有其他更好的地方来发布我的问题。）
I am a newbie tester for a web site. The backend of this site are several SQL Server databases. The UI is built with Ajax and ASP.NET. The whole site is hosted on Windows Server 2008. The site's strucuture is like this: several IIS web applications interact with a core WCF web service. This WCF web service is also a IIS web application.
Now I have got familiar with the site's workflow as a customer. It's quite simple. Just some mouse clicks on the button. But my mentor told me that there're quite a lot of test points during this "simple clicks". So what could they be?
Also, since I am totally new to this, could anyone give me advices on what aspects could I test this web site? Like function? Security? Performance? And so on. (The more detailed, the better.)
Update
It seems I am not used to thinking as a tester yet. So I would greatly appreciate any insights which could help me re-format my brain~ :)
Many many thanks.
(Also, I'd like to thank S.O. I know no other better place to post my questions.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
从质量保证的角度来看，非常重要的是非黄金路径。这意味着，就像客户一样，不仅仅是将商品添加到购物车并结账。做一些奇怪的事情。假设您想要 9999 的商品，请尝试运送到萨拉热窝（我喜欢这个城市）。尽你所能，从本质上胜过开发人员。你的工作是提出我们（开发人员）没有涵盖的合法场景。
从安全方面来说，熟悉跨站点脚本和跨站点请求伪造。这些将是您可能遇到的两个重击者。寻找用户输入被发送到数据库的场景，并确保在继续之前将其清理干净。
From a QA Perspective, what is very important are the non-Golden paths. This means, act like a customer who didn't just add an item to their cart and checkout. Do weird things. Say you want 9999 of an item, try to ship to Sarajevo (I love this city). Do whatever you can to essentially outsmart the developers. Your job is to come up with scenarios that are legit, that we(developers) didn't cover.
From the security side, familiarize yourself with Cross Site Scripting, and Cross Site request forgery. These are going to be the 2 heavy hitters that you are likely to run into. Look for scenarios where user input is being sent to the database, and make sure it is cleaned before going on it's way.