1.放注入函数
sub aspsql()
SQL_injdata = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"
SQL_inj = split(SQL_Injdata,"|")
If Request.Form<>"" Then
For Each Sql_Post In Request.Form
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then
response.write "<mce:script language='javascript'><!--
"
response.write "alert('网站安全提示：请不要在参数中包含非法字符！');"
response.write "location.href='javascript:history.go(-1)';"
response.write "
// --></mce:script>"
response.end
end if
next
next
end if
If Request.QueryString<>"" Then
For Each SQL_Get In Request.QueryString
For SQL_Data=0 To Ubound(SQL_inj)
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then
response.write "<mce:script language='javascript'><!--
"
response.write "alert('网站安全提示：请不要在参数中包含非法字符！');"
response.write "location.href='javascript:history.go(-1) ......
<%
'asp多风格分页类
'使用范例
'==========================================================================
'Set test = New Page '创建啦
'test.CurrentPage=1 '自己去读取拉,当前的页数
'test.temp="{N1}{N2}{N3} {N4}"'这里是显示的模版,自己可以定义,至于标签,可以自己去那个类里找
'test.Exec "Select * from [movie]",conn '这里执行sql语句,conn就是数据连接对象了
'test.Show 1 '显示分页样式,可以根据用户输入的参数把这里的1换成变量
'=====================================================================
Class Page
Private CurrPage
Private PageN
Private UrlStr
Private TempStr
Private ErrInfo
Private IsErr
Private TotalRecord
Private TotalPage
Public PageRs
Private TempA(11)
Private TempB(8)
'------------------------------------------------------------
Private Sub Class_Initialize()
CurrPage=1'//默认显示当前页为第一页
PageN=10'//默认每页显示10条数据
UrlStr="#"
TempStr=""
ErrInfo="ErrInfo:"
IsErr=False
End Sub
Private Sub Class_Terminate()
If IsObject(PageRs) ......
1.UpLoadClass.asp
<%
Class UpLoadClass
Private p_MaxSize,p_FileType,p_SavePath,p_AutoSave,p_Error
Private objForm,binForm,binItem,strDate,lngTime
Public FormItem,FileItem
Public Property Get Version
Version=""
End Property
Public Property Get Error
Error=p_Error
End Property
Public Property Get MaxSize
MaxSize=p_MaxSize
End Property
Public Property Let MaxSize(lngSize)
if isNumeric(lngSize) then
p_MaxSize=clng(lngSize)
end if
End Property
Public Property Get FileType
FileType=p_FileType
End Property
Public Property Let FileType(strType)
p_FileType=strType
End Property
Public Property Get SavePath
SavePath=p_SavePath
End Property
Public Property Let SavePath(strPath)
p_SaveP ......
1.html代码 formname是表单name,editname是文件域name,uppath是上传文件保存路径.
<input name="qtxx" type="text" id="qtxx" size="50" />
<input type="button" name="Submit22" value="上传图片" onClick="window.open('upload.asp?formname=from1&editname=qtxx&uppath=../UpLoadFile&filelx=jpg','','status=no,scrollbars=no,top=20,left=110,width=420,height=165')">
2.upload.asp
<%
uppath=request("uppath")&"/"
filelx=request("filelx")
formName=request("formName")
EditName=request("EditName")
%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<link href="css.css" mce_href="css.css" rel="stylesheet" type="text/css">
<mce:script language="javascript"><!--
function mysub()
{
esave.style.visibility="visible";
}
// --></mce:script>
<title>图片上传</title></head>
<body>
<form name="form1" method="post ......
<!--#include file="config.asp" -->
<!--#include file="Fun.asp" -->
<%
'数据库管理类
class Datas
'备份
public sub Bk()
Set fso=server.createobject("scripting.filesystemobject")
fso.CopyFile Server.MapPath(SiteDataPath),Server.MapPath(SiteDataBakPath)
set fso=nothing
response.Write("<mce:script language=javascript><!--
alert('备份成功！');window.location.href='DataManage.asp'
// --></mce:script>")
end sub
'还原
public sub Rt()
SDPath = server.mappath(SiteDataPath)
SDBPath = server.mappath(SiteDataBakPath)
set Fso=Server.CreateObject("Scripting.FileSystemObject")
if Fso.FileExists(SDBPath) then
Fso.CopyFile SDBPath,SDPath
Set Fso=nothing
response.Write("<mce:script language=javascript><!--
alert('成功：你已经成功恢复数据库!');window.location.href='DataManage.asp?action=rt'
// --></mce:script>")
else
response.Write("<mce ......
<!--#include file="config.asp" -->
<!--#include file="Fun.asp" -->
<%
'数据库管理类
class Datas
'备份
public sub Bk()
Set fso=server.createobject("scripting.filesystemobject")
fso.CopyFile Server.MapPath(SiteDataPath),Server.MapPath(SiteDataBakPath)
set fso=nothing
response.Write("<mce:script language=javascript><!--
alert('备份成功！');window.location.href='DataManage.asp'
// --></mce:script>")
end sub
'还原
public sub Rt()
SDPath = server.mappath(SiteDataPath)
SDBPath = server.mappath(SiteDataBakPath)
set Fso=Server.CreateObject("Scripting.FileSystemObject")
if Fso.FileExists(SDBPath) then
Fso.CopyFile SDBPath,SDPath
Set Fso=nothing
response.Write("<mce:script language=javascript><!--
alert('成功：你已经成功恢复数据库!');window.location.href='DataManage.asp?action=rt'
// --></mce:script>")
else
response.Write("<mce ......
ASP函数与VBSCRIPT类似，以下举一些常用的函数
Array()
函数返回一个数组
表达式 Array(list)
允许数据类型: 字符，数字均可
实例： <%
Dim myArray()
For i = 1 to 7
Redim Preserve myArray(i)
myArray(i) = WeekdayName(i)
Next
%>
返回结果: 建立了一个包含7个元素的数组myArray
myArray("Sunday","Monday", ... ... "Saturday"
CInt()
函数将一个表达式转化为数字类型
表达式 CInt(expression)
允许数据类型: 任何有效的字符均可
实例： <%
f = "234"
response.write cINT(f) + 2
%>
返回结果: 236
转化字符"234"为数字"234"，如果字符串为空，则返回0值
CreateObject()
函数建立和返回一个已注册的ACTIVEX组件的实例。
表达式 CreateObject(objName)
允许数据类型: objName 是任何一个有效、已注册的ACTIVEX组件的名字.
实例： <%
Set con = Server.CreateObject("ADODB.Connection"
%>
� ......
最新文章 : asp