該檔案可以包含在任何需要調用資料庫的ASP檔案頭部,直接過慮掉非法注入

來源:互聯網
上載者:User
資料|資料庫 <%'該檔案可以包含在任何需要調用資料庫的ASP檔案頭部,直接過慮掉非法注入
'調用方法為:<!-- #include file="safe.asp" -->
Function Safe(str)'該函數用來判斷傳遞過來的變數是否包含特殊字元,沒有返回TRUE
Dim s_BadStr, n, i
s_BadStr = "'  &<>?%,;:()`~!@#$^*{}[]|\/+-="&Chr(34)&Chr(9)&Chr(32)
n = Len(s_BadStr)
Safe = True
For i = 1 To n
If Instr(str, Mid(s_BadStr, i, 1)) > 0 Then
Safe = False
Exit Function
End If
Next
End Function
'以下代碼直接判斷髮生請求的URL是否包含非法字元
On Error Resume Next
Dim strTemp

If LCase(Request.ServerVariables("HTTPS")) = "off" Then
strTemp = "http://"
Else
strTemp = "https://"
End If
strTemp = strTemp & Request.ServerVariables("SERVER_NAME")
If Request.ServerVariables("SERVER_PORT") <> 80 Then strTemp = strTemp & ":" & Request.ServerVariables("SERVER_PORT")
strTemp = strTemp & Request.ServerVariables("URL")
If Trim(Request.QueryString) <> "" Then strTemp = strTemp & "?" & Trim(Request.QueryString)
strTemp = LCase(strTemp)
If Instr(strTemp,"select%20") or Instr(strTemp,"insert%20") or Instr(strTemp,"delete%20from") or Instr(strTemp,"count(") or Instr(strTemp,"drop%20table") or Instr(strTemp,"update%20") or Instr(strTemp,"truncate%20") or Instr(strTemp,"asc(") or Instr(strTemp,"mid(") or Instr(strTemp,"char(") or Instr(strTemp,"xp_cmdshell") or Instr(strTemp,"exec%20master") or Instr(strTemp,"net%20localgroup%20administrators") or Instr(strTemp,"db_name(") or Instr(strTemp,"net%20user") or Instr(strTemp,"'") or Instr(strTemp,"%20or") or Instr(strTemp,"backup%20") then
Response.Write "<script language='javascript'>"
Response.Write "alert('非法地址!!');"
Response.Write "location.href='http://www.myzone.cn';"
Response.Write "</script>"
End If

For Each name In Request.Form
Dim s_BadStr, s_Sz, i
s_BadStr = "'|and|select|update|chr|delete|from|;|insert|mid|master.|truncate|db_name|xp_cmdshell|exec%20master|net%20localgroup%20administrators|drop|table|db_name(|exec"
s_Sz = split(s_BadStr,"|")
For i = 0 To ubound(s_Sz)
If Instr(Request.Form(name), s_Sz(i)) > 0 Then
Response.Write "<script language='javascript'>"
Response.Write "alert('非法地址!!');"
Response.Write "location.href='http://www.myzone.cn';"
Response.Write "</script>"
End If
Next
next
%>




相關文章

Beyond APAC's No.1 Cloud

19.6% IaaS Market Share in Asia Pacific - Gartner IT Service report, 2018

Learn more >

Apsara Conference 2019

The Rise of Data Intelligence, September 25th - 27th, Hangzhou, China

Learn more >

Alibaba Cloud Free Trial

Learn and experience the power of Alibaba Cloud with a free trial worth $300-1200 USD

Learn more >

聯繫我們

該頁面正文內容均來源於網絡整理,並不代表阿里雲官方的觀點,該頁面所提到的產品和服務也與阿里云無關,如果該頁面內容對您造成了困擾,歡迎寫郵件給我們,收到郵件我們將在5個工作日內處理。

如果您發現本社區中有涉嫌抄襲的內容,歡迎發送郵件至: info-contact@alibabacloud.com 進行舉報並提供相關證據,工作人員會在 5 個工作天內聯絡您,一經查實,本站將立刻刪除涉嫌侵權內容。