Perfect filtering of redundant parameters in ASP

Author: sunlion [e.s. T] (Blood Dance [e.s. T])
Source: evil baboons China

I wrote a post about parameter filtering last time. I remember that I used the instr function and only compared some parameters. To make it possible to filter many parameters, so we need to add a lot of filtering symbols in the comparison area. Today, today, I bring you a more perfect filtering method, that is, using an isnumeric () in Microsoft VBScript () function! Let's talk a little bit about it. Let's take a look at his description and usage:
Isnumeric Function Description
Returns a Boolean value to indicate whether the expression value is a number.
Syntax
Isnumeric (expression)
The expression parameter can be any expression.
Description
If the entire expression is recognized as a number, the isnumeric function returns true;
Otherwise, the function returns false.
If expression is a date expression, the isnumeric function returns false.
Okay. Do you understand this?
The isnumeric () function is used to compare the expressions in parentheses to see if it is a number. If it is a number, true is returned. If it is not a number, false is returned. Based on this principle, then we can use
If not isnumeric (request. querystring ("ID") Then response. Redirect "index. asp"
In the same way, you can add what you want after then.
Response. End
End!
Now I want to explain the following: if the parameter after the ID in the IE address bar is not a number, then the statement after then is implemented!
As you can see, this is the butler's place, so I say "Perfect filtering "!
For example, when you check for vulnerabilities, you usually add some special symbols behind the ID to achieve our goal! And the function is our natural enemy!
As long as you add a metaphor (') or (;) or (,) or (and 1 = 1)... and so on after the ID,
Make the ID has been changed to a non-number, that is, the statement following then is implemented!
So as to achieve our goal of filtering!
Haha, okay. Let's talk about parameter filtering today!
Now I want to work :(!