'===========================
'过滤提交表单中的SQL
'===========================
함수 ForSqlForm()
희미한 fqys,errc,i,항목
어둡지 않아(18)
nothis(0)="net user"
nothis(1)="xp_cmdshell"
nothis(2)="/add"
nothis(3)="exec%20master.dbo.xp_cmdshell"
nothis(4)="net localgroup Administrators"
nothis(5)="select"
nothis(6)="count"
nothis(7)="asc"
nothis(8)="char"
nothis(9)="mid"
nothis(10)="'"
nothis( 11)=":"
nothis(12)=""""
nothis(13)="삽입"
nothis(14)="삭제"
nothis(15)="삭제"
nothis(16)="잘라내기"
nothis(17 )="from"
notthis(18)="%"
'nothis(19)="@"
errc=false
for i= 0에서 ubound(nothis)까지
request.Form의 각 항목에 대해
if instr(request.Form(items),nothis(i))<>0 then
response.write("<div>")
response.write("你所填写的信息:" & server.HTMLEncode(request.Form(items)) & "<br>含不法字符:" & notthis(i))
response.write("</div>")
response.write("对不起,你所填写的信息含不平字符!<a href=""#"" onclick=""history.back()"">返回</a>")
응답.끝()
종료하면
다음
다음
함수 종료
'===========================
'过滤查询中的SQL
'===========================
함수 ForSqlInjection()
희미한 fqys,errc,i
어둡지 않아(19)
fqys = request.ServerVariables("QUERY_STRING")
nothis(0)="net user"
nothis(1)="xp_cmdshell"
nothis(2)="/add"
nothis(3)="exec%20master.dbo.xp_cmdshell"
nothis(4)="net localgroup Administrators"
nothis(5)="select"
nothis(6)="count"
nothis(7)="asc"
nothis(8)="char"
nothis(9)="mid"
nothis(10)="'"
nothis( 11)=":"
nothis(12)=""""
nothis(13)="삽입"
nothis(14)="삭제"
nothis(15)="삭제"
nothis(16)="잘라내기"
nothis(17 )="from"
notthis(18)="%"
nothis(19)="@"
errc=false
for i= 0 to ubound(nothis)
if instr(FQYs,nothis(i))<>0 then
errc=true
end if
next
if errc then
response.write "查询信息含비법자문!<a href=""#"" onclick=""history.back()"">返回</a>"
response.end
end if
end 함수