hzhost·Àasp¹¥»÷º¯Êý
hzhost·Àasp¹¥»÷º¯Êý
Function SafeRequest(ParaName)
Dim ParaValue
ParaValue=Request(ParaName)
if IsNumeric(ParaValue) then
SafeRequest=ParaValue
exit Function
else
ParaValuetemp=lcase(ParaValue)
tempvalue="select
|insert |delete from|'|count(|drop table|update |truncate
|asc(|mid(|char(|xp_cmdshell|exec master|net localgroup
administrators|net user| or | and |%20from"
temps=split(tempvalue,"|")
for mycount=0 to ubound(temps)
if Instr(ParaValuetemp,temps(mycount)) > 0 then
call errorpage(-2,"·Ç·¨ÇëÇ󣡣¡£¡")
response.end
end if
next
SafeRequest=ParaValue
end if
End function
'=================
Ïà¹ØÎĵµ£º
ÔÎÄÒýÓÃ:
http://www.17558.net/cmd.asp?act=tb&id=16&key=43840
ÔÎĵØÖ·:http://www.17558.net/post/16.html
żÊÇÒ»¸öµ×²ãµÄASP¼¼ÊõÈËÔ±(ÊôÓÚ°ë·³ö¼ÒµÄÄÇÖÖ,ÒÔǰÊÇÒ»ÃûÍøÂç¼¼ÊõÈËÔ±),×î½ü²ÎÓëÖÆ×÷Ò»¸öCRMϵͳ,¼Ü¹»²ÉÓÃASP+SQL,¿¼Âǵ½ÒÔºóÊý¾Ý²éѯЧÂÊÎÊÌâ,ËùÒÔÔÚÍøÉÏÕÒÁËÒ»¸ö AspÊý¾Ý²Ù×÷×é¼þ(°ÙÍò¼¶·ÖÒ³) , ......
ActiveConnection ÉèÖûò·µ»ØCommand¶ÔÏóµÄÁ¬½ÓÐÅÏ¢£¬¸ÃÊôÐÔ¿ÉÒÔÊÇÒ»¸öConnection¶ÔÏó»òÁ¬½Ó×Ö·û´®¡£
CommandText ÉèÖûò·µ»Ø¶ÔÊý¾ÝÔ´µÄÃüÁî´®£¬Õâ¸ö´®¿ÉÒÔÊÇSQLÓï¾ä¡¢±í¡¢´¢´æ¹ý³Ì»òÊý¾ÝÌṩÕßÖ§³ÖµÄÈÎ ºÎÌØÊâÓÐЧµÄÃüÁîÎı¾¡£
Prepared Ìá³öÔÚµ÷ÓÃCommand¶ÔÏóµÄExecute·½·¨Ê±£¬ÊÇ·ñ½«²éѯµÄ±àÒë½á¹û´¢´æÏÂÀ´¡£Èç¹û½«¸ ......
set conn=server.createobject("adodb.connection")
conn.open "driver={microsoft access driver (*.mdb)};dbq=F:\\ajaxpro\\App_Data\\server.mdb"
Dim StrSQL,RS
StrSQL="SELECT*from Manager WHERE ID='"&username&"'"
StrSQL=StrSQL&"AND Pin='"&passwor ......
Ö±±¼Ö÷Ìâ.
ĿǰÔÚά»¤Ò»Ì×´óÐ͵ÄASPÊÛºóϵͳ(2000¶à¸öasp page),´úÂëÊÇ2001Äê³öÀ´µÄ,ÆÚ¼ä¶àÄêδ×ö¸üÐÂ,´úÂëÖвÎÔÓ¶à¸ö³ÌÐòÔ±µÄ·ç¸ñ,½á¹¹ÉÏÖ»ÊǼòµ¥µÄ½«main function ¼¯ÖÐÆðÀ´,½«¸´ÔÓµÄsql¼¯ÖÐÆðÀ´. Ò³ÃæÉÏÏ൱»ìÂÒ.
ûÓмòµ¥µØÈ¥×ªÏò.net»·¾³,ÒòΪÕâ¸öÏµÍ³Ê¹Ó ......
ºÜ¶àSOHOER¶¼Ï£ÍûÓиö×Ô¼ºµÄÍøÕ¾,¶ø¶ÔÍøÕ¾½¨ÉèÒ»ÎÞËùÖª,»òÕßÒ»Öª°ë½â.½ñÌìÎÒÏȽ²³ÌÐò·½ÃæµÄÇø±ð,ÏàÐźܶàÈËÅöµ½ÁËÓÐЩ¹«Ë¾Ëµphp±ÈAsp,Asp.Net¶¼ÒªºÃ,»òÕßAsp±ÈÆäËûÓïÑÔ¶¼ÒªºÃ¡£Æäʵ,³ÌÐòµÄÓÅÂÔÓëÍøÕ¾¿ª·¢ÈËÔ±µÄ¾Ñé\¼¼ÊõˮƽÏà¹Ø£¬¶øÓïÑÔ±¾Éí²¢Ã»ÓÐʲôÓÅÂÔÖ®·Ö.¾Ñé¶àµÄ³ÌÐòÔ±,²»¹ÜʹÓõÄÄ ......