I guess one problem could be the kind of spam they post. If they post links to other websites which in turn try infect the visitor with malware it doesn't pose a direct threat to your site but to your visitors.
You should also make sure they can't insert scripts etc to prevent XSS.
From a security perspective, this is really a question about how secure your website is in general. Yes, a spambot could exploit vulnerabilities but then so could any user, be they human or robot.
You mentioned parametrisation of SQL which is a good start, try these as well:
Are you validating all input against a whitelist of trusted values?
Are you applying the principle of least privilege and not allowing the SQL account public users connect with to do more than it needs? (more on that here)
Are you output encoding every piece of data when it's presented back via the UI?
If you're doing all this then you're in good shape security wise. Dealing with the inconvenience created by bots is another issue altogether.
发布评论
评论（3）
您可能遇到的任何安全风险完全独立于是否批量提交表单。
唯一的新安全风险与机器人填满磁盘时发生的情况有关。
Any security risks you may have are completely independent of whether the form is being submitted in bulk.
The only new security risk relates to what happens if the bots fill up your disk.
我想一个问题可能是他们发布的垃圾邮件类型。如果他们发布指向其他网站的链接，而这些网站又试图用恶意软件感染访问者，那么它不会对您的网站造成直接威胁，而是对您的访问者构成直接威胁。
您还应该确保他们无法插入脚本等以防止 XSS。
维基百科上的 XSS
I guess one problem could be the kind of spam they post. If they post links to other websites which in turn try infect the visitor with malware it doesn't pose a direct threat to your site but to your visitors.
You should also make sure they can't insert scripts etc to prevent XSS.
XSS on wikipedia
从安全角度来看，这实际上是一个关于您的网站总体安全程度的问题。是的，垃圾邮件机器人可以利用漏洞，但任何用户，无论是人类还是机器人，都可以利用漏洞。
您提到了 SQL 参数化，这是一个好的开始，也可以尝试这些：
如果您执行了所有这些操作，那么您在安全方面就处于良好状态。处理机器人带来的不便完全是另一个问题。
From a security perspective, this is really a question about how secure your website is in general. Yes, a spambot could exploit vulnerabilities but then so could any user, be they human or robot.
You mentioned parametrisation of SQL which is a good start, try these as well:
If you're doing all this then you're in good shape security wise. Dealing with the inconvenience created by bots is another issue altogether.