问题描述
这是段ASP的代码：我是.net的，看不懂，但是老板让看明白<%squery=lcase(Request.ServerVariables("QUERY_STRING"))sURL=lcase(Request.ServerVariables("HTTP_HOST"))allquery=squery+sURLifInStr(allquery,"%27")<>0orInStr(allquery,"'")<>0orInStr(allquery,"%a1a1")<>0orInStr(allquery,"%24")<>0orInStr(allquery,"$")<>0orInStr(allquery,"%3b")<>0orInStr(allquery,";")<>0orInStr(allquery,":")<>0orInStr(allquery,"%%")<>0orInStr(allquery,"%3c")<>0orInStr(allquery,"<")<>0orInStr(allquery,">")<>0orInStr(allquery,"--")<>0orInStr(allquery,"sp_")<>0orInStr(allquery,"xp_")<>0orInStr(allquery,"exec")<>0orInStr(allquery,"")<>0orInStr(allquery,"delete")<>0orInStr(allquery,"dir")<>0orInStr(allquery,"exe")<>0orInStr(allquery,"cmd")<>0orInStr(allquery,"*")<>0orInStr(allquery,"^")<>0orInStr(allquery,"(")<>0orInStr(allquery,")")<>0orInStr(allquery,"+")<>0orInStr(allquery,"copy")<>0orInStr(allquery,"format")<>0thenresponse.Write"<scriptlanguage=javascript>alert('对不起，请不要非法测试本程序');location.href='index.asp';</script>"Response.Endendif'OnErrorResumeNextstrsql="Provider=SQLOLEDB.1;UserID=sa;password=sa;InitialCatalog=jks;DataSource=(local)"setconn=server.createobject("adodb.connection")conn.openstrsqlfunctionProgramErr()iferr<>0thenresponse.write"<script>alert('很抱歉程序发生错误，请正确重试操作n错误描述："&Err.Description&"n')</script>"endiferr.clearConn.closeSetconn=NothingEndFunction%>
解决方案
解决方案二：
ifInStr(allquery,"%27")<>0orInStr(allquery,"'")<>0orInStr(allquery,"%a1a1")<>0orInStr(allquery,"%24")<>0orInStr(allquery,"$")<>0orInStr(allquery,"%3b")<>0orInStr(allquery,";")<>0orInStr(allquery,":")<>0orInStr(allquery,"%%")<>0orInStr(allquery,"%3c")<>0orInStr(allquery,"<")<>0orInStr(allquery,">")<>0orInStr(allquery,"--")<>0orInStr(allquery,"sp_")<>0orInStr(allquery,"xp_")<>0orInStr(allquery,"exec")<>0orInStr(allquery,"")<>0orInStr(allquery,"delete")<>0orInStr(allquery,"dir")<>0orInStr(allquery,"exe")<>0orInStr(allquery,"cmd")<>0orInStr(allquery,"*")<>0orInStr(allquery,"^")<>0orInStr(allquery,"(")<>0orInStr(allquery,")")<>0orInStr(allquery,"+")<>0orInStr(allquery,"copy")<>0orInStr(allquery,"format")<>0then这一堆是防止注入的一些判断strsql="Provider=SQLOLEDB.1;UserID=sa;password=sa;InitialCatalog=jks;DataSource=(local)"setconn=server.createobject("adodb.connection")conn.openstrsql是打开数据库的方法
解决方案三：
·双线主机100M/35元/年,免费送数据库(自选MY/MSSQL)·详情请访问：
解决方案四：
1楼正解.
解决方案五：
顶