From & amp; #39; or & amp; #39 ;=& amp; #39; or & amp; #39;

There are many ways to implement the repair. Here we will introduce two methods. We will use 2nd.
Method 1: Replace characters
Solution: Find the <from under login. asp and find a similar

Username = request. Form ("name ")
Pass = request. Form ("pass ")

To:
Username = Replace (request. Form ("name "),"'","''")
Pass = Replace (request. Form ("pass "),"'","''")

The syntax is to block the 'and' characters to achieve the effect.

Method 2: Add <! -- # Include file = "safe. asp" -->
Note: <! -- # Include file = "conn. asp" -->)

Save the following code as safe. asp

The following is the program code ************************************ ********************
<%
Dim Query_Badword, Form_Badword, I, Err_Message, Err_Web, name
Err_Message = 3
Err_Web = "safe.htm"
'Page for turning when an error occurs

Query_Badword = "'| and | select | update | chr | delete | % 20from |; | insert | mid | master. | set | chr (37) | ="
'Invalid get parameters are defined in this part. Use the "|" Interval

Form_Badword = "'| (|) |; | ="
'Invalid post parameters are defined in this part. Use the "|" Interval

On Error Resume Next

If request. QueryString <> "then
Chk_badword = split (Query_Badword, "| ")
For each Query_Name IN Request. QueryString
For I = 0 to ubound (Chk_badword)
If Instr (LCase (request. QueryString (Query_Name), Chk_badword (I) <> 0 Then
Select Case Err_Message
Case "1"
Response. Write "<Script Language = JavaScript> alert ('parameter passing error! The value of the parameter "& name &" contains an invalid string! Do not include invalid characters such as: and update delete; insert mid master in the parameter! '); Window. close (); </Script>"
Case "2"
Response. Write "<Script Language = JavaScript> location. href = '" & Err_Web & "' </Script>"
Case "3"
Response. Write "<Script Language = JavaScript> alert ('parameter passing error! The value of the parameter "& name &" contains an invalid string! Do not include invalid characters such as: and update delete; insert mid master in the parameter! '); Location. href =' "& Err_Web &" '; </Script>"
End Select
Response. End
End If
NEXT
NEXT
End if
If request. form <> "" then
Chk_badword = split (Form_Badword, "| ")
For each name IN Request. Form
For I = 0 to ubound (Chk_badword)
If Instr (LCase (request. form (name), Chk_badword (I) <> 0 Then
Select Case Err_Message
Case "1"
Response. Write "<Script Language = JavaScript> alert ('error! The value of Form "& name &" contains an invalid string! Your illegal operations have been recorded. Please stop the illegal activities immediately! '); Window. close (); </Script>"
Case "2"
Response. Write "<Script Language = JavaScript> location. href = '" & Err_Web & "' </Script>"
Case "3"
Response. Write "<Script Language = JavaScript> alert! The value of the parameter "& name &" contains an invalid string! Thank you for coming !, Please stop illegal behavior! '); Location. href =' "& Err_Web &" '; </Script>"
End Select
Response. End
End If
NEXT
NEXT
End if
%>