zoukankan
html css js c++ java
ASP上两个防止SQL注入式攻击Function
'
'==========================
'
'过滤提交表单中的SQL
'
'==========================
function
ForSqlForm()
dim
fqys,errc,i,items
dim
nothis(
18
)
nothis(
0
)
=
"
net user
"
nothis(
1
)
=
"
xp_cmdshell
"
nothis(
2
)
=
"
/add
"
nothis(
3
)
=
"
exec%20master.dbo.xp_cmdshell
"
nothis(
4
)
=
"
net localgroup administrators
"
nothis(
5
)
=
"
select
"
nothis(
6
)
=
"
count
"
nothis(
7
)
=
"
asc
"
nothis(
8
)
=
"
char
"
nothis(
9
)
=
"
mid
"
nothis(
10
)
=
"
''
"
nothis(
11
)
=
"
:
"
nothis(
12
)
=
"
""
"
nothis(
13
)
=
"
insert
"
nothis(
14
)
=
"
delete
"
nothis(
15
)
=
"
drop
"
nothis(
16
)
=
"
truncate
"
nothis(
17
)
=
"
from
"
nothis(
18
)
=
"
%
"
'
'nothis(19)="@"
errc
=
false
for
i
=
0
to
ubound
(nothis)
for
each
items in request.Form
if
instr
(request.Form(items),nothis(i))
<>
0
then
response.write(
"
<div>
"
)
response.write(
"
你所填写的信息:
"
&
server.HTMLEncode(request.Form(items))
&
"
<br>含非法字符:
"
&
nothis(i))
response.write(
"
</div>
"
)
response.write(
"
对不起,你所填写的信息含非法字符!<a href=""#"" onclick=""history.back()"">返回</a>
"
)
response.End()
end
if
next
next
end function
'
'==========================
'
'过滤查询中的SQL
'
'==========================
function
ForSqlInjection()
dim
fqys,errc,i
dim
nothis(
19
)
fqys
=
request.ServerVariables(
"
QUERY_STRING
"
)
nothis(
0
)
=
"
net user
"
nothis(
1
)
=
"
xp_cmdshell
"
nothis(
2
)
=
"
/add
"
nothis(
3
)
=
"
exec%20master.dbo.xp_cmdshell
"
nothis(
4
)
=
"
net localgroup administrators
"
nothis(
5
)
=
"
select
"
nothis(
6
)
=
"
count
"
nothis(
7
)
=
"
asc
"
nothis(
8
)
=
"
char
"
nothis(
9
)
=
"
mid
"
nothis(
10
)
=
"
''
"
nothis(
11
)
=
"
:
"
nothis(
12
)
=
"
""
"
nothis(
13
)
=
"
insert
"
nothis(
14
)
=
"
delete
"
nothis(
15
)
=
"
drop
"
nothis(
16
)
=
"
truncate
"
nothis(
17
)
=
"
from
"
nothis(
18
)
=
"
%
"
nothis(
19
)
=
"
@
"
errc
=
false
for
i
=
0
to
ubound
(nothis)
if
instr
(FQYs,nothis(i))
<>
0
then
errc
=
true
end
if
next
if
errc
then
response.write
"
查询信息含非法字符!<a href=""#"" onclick=""history.back()"">返回</a>
"
response.end
end
if
end function
查看全文
相关阅读:
复利计算(修改后)
复利计算测试(C语言)
实验一、命令解释程序的编写
《构建之法》之第一二三章读后感
复利计算1.0 2.0 3.0
复利计算总结
Scrum 项目7.0——第一个Sprint的总结和读后感
Scrum 项目7.0——第一个Sprint的演示和回顾
Scrum 项目4.0&&5.0
操作系统——进程调度模拟程序
原文地址:https://www.cnblogs.com/flyfish/p/386047.html
最新文章
《构建之法》1、2、3章读后感
复利感想
复利作业
操作系统实验0
0302作业
12.03自动机实验
评论
实验一 命令解释程序的编写
构建之法:1、2、3章阅读后感
复利计算4.0
热门文章
复利计算3.0
复利计算2.0
实验0:了解和熟悉操作系统
0302思考并回答一些问题
1203有穷自动机
1216递归下降语法分析程序
汉堡
复利计算5.0
复利计算5.0——结对(总结)
《构建之法》第四章读后感
Copyright © 2011-2022 走看看