Abstract: With the rapid development of the internet, the problems of Web security are more and more serious, almost everyday lots of websites have been tampered, or injected with trojans horse, backdoors and other malicious programs. The scanning products of website security have sprung up, although these products cannot protect websites, they can help administrators understand vulnerabilities and security risks. But how to define the quality of these products? In this paper, website security scanning principles are explained in detail, after the comparative analysis, some suggestions on how to improve the capability of website security scanner are put forward.

Key words: vulnerability, Web spider, SQL injection, XSS vulnerability