& Amp; #39; or & amp; #39 ;=& amp; #39; or & amp; #39; patch end

Method 1: Replace characters
Solution: Find <from under login. asp and find username = request. Form ("name ")

Pass = request. Form ("pass ")
Change to: username = Replace (request. Form ("name "),"'","''")

Pass = Replace (request. Form ("pass "),"'","''")
The syntax is to block the 'and' characters to achieve the effect.

Method 2: Add <! -- # Include file = "safe. asp" -->
Note: <! -- # Include file = "conn. asp" -->)
Save the following code as safe. asp

Program code <%

Dim Query_Badword, Form_Badword, I, Err_Message, Err_Web, name

Err_Message = 3

Err_Web = "safe.htm"

'Page for turning when an error occurs

 

Query_Badword = "'| and | select | update | chr | delete | % 20from |; | insert | mid | master. | set | chr (37) | ="

'Invalid get parameters are defined in this part. Use the "|" Interval

 

Form_Badword = "'| (|) |; | ="

'Invalid post parameters are defined in this part. Use the "|" Interval

 

On Error Resume Next

 

If request. QueryString <> "then

Chk_badword = split (Query_Badword, "| ")

For each Query_Name IN Request. QueryString

For I = 0 to ubound (Chk_badword)

If Instr (LCase (request. QueryString (Query_Name), Chk_badword (I) <> 0 Then

Select Case Err_Message

Case "1"

Response. Write "<Script Language = JavaScript> alert ('parameter passing error! The value of the parameter "& name &" contains an invalid string! Do not include invalid characters such as: and update delete; insert mid master in the parameter! '); Window. close (); </Script>"

Case "2"

Response. Write "<Script Language = JavaScript> location. href = '" & Err_Web & "' </Script>"

Case "3"

Response. Write "<Script Language = JavaScript> alert ('parameter passing error! The value of the parameter "& name &" contains an invalid string! Do not include invalid characters such as: and update delete; insert mid master in the parameter! '); Location. href =' "& Err_Web &" '; </Script>"

End Select

Response. End

End If

NEXT

NEXT

End if

If request. form <> "" then

Chk_badword = split (Form_Badword, "| ")

For each name IN Request. Form

For I = 0 to ubound (Chk_badword)

If Instr (LCase (request. form (name), Chk_badword (I) <> 0 Then

Select Case Err_Message

Case "1"

Response. Write "<Script Language = JavaScript> alert ('error! The value of Form "& name &" contains an invalid string! Your illegal operations have been recorded. Please stop the illegal activities immediately! '); Window. close (); </Script>"

Case "2"

Response. Write "<Script Language = JavaScript> location. href = '" & Err_Web & "' </Script>"

Case "3"

Response. Write "<Script Language = JavaScript> alert ('error! The value of the parameter "& name &" contains an invalid string! Thank you for coming !, Please stop illegal behavior! '); Location. href =' "& Err_Web &" '; </Script>"

End Select

Response. End

End If

NEXT

NEXT

End if

%>