高校问答赏析天净沙秋思150字:[!!!!!!!!!!]asp提交参数过滤方法[!!!!!!!!!!]
来源：百度文库 编辑：高校问答 时间：2024/05/01 19:13:58
我的文件注入漏洞很致命，大家看
id1 = Request("id")
if Request("id")="" then
response.Write("请输入要查看的的ID")
Else
sql="select * from xy_news where id = "+id1
rs.Open sql,conn,1,3
if rs.EOF then
response.redirect "/"
else
在id1 = Request("id")中如何定义id1的类型
我直接在前面写
dim id1 as Integer
dim id as Integer
行不？
我是新手，讲的详细些
前面那个问题我回了,在这里再回一下:
<%
Function SafeReplace(ParaName)
'--- 传入参数 ---
'ParaName:参数名称-字符型
Dim Paravalue
Paravalue=LCase(Trim(ParaName))
Paravalue=Replace(Paravalue,"select","")
Paravalue=Replace(Paravalue,"insert","")
Paravalue=Replace(Paravalue,"updata","")
Paravalue=Replace(Paravalue,"addnew","")
Paravalue=Replace(Paravalue,"delete","")
Paravalue=Replace(Paravalue,"order","")
Paravalue=Replace(Paravalue,"and","")
Paravalue=Replace(Paravalue,"or","")
Paravalue=Replace(Paravalue,"exec","")
Paravalue=Replace(Paravalue,"--","")
Paravalue=Replace(Paravalue,"-","")
Paravalue=Replace(Paravalue,";","")
Paravalue=Replace(Paravalue,"%","")
Paravalue=Replace(Paravalue,"<","")
Paravalue=Replace(Paravalue,">","")
Paravalue=Replace(Paravalue,"(","")
Paravalue=Replace(Paravalue,")","")
Paravalue=Replace(Paravalue,"window.open","")
Paravalue=Replace(Paravalue,"window.close","")
Paravalue=Replace(Paravalue,"while(1)","")
Paravalue=Replace(Paravalue,"script","")
Paravalue=Replace(Paravalue,"'","")
Paravalue=Replace(Paravalue,chr(34),"")
Paravalue=Replace(Paravalue,chr(39),"")
SafeReplace=Paravalue
End function
Function SafeRequest(ParaName,ParaType)
'--- 传入参数 ---
'ParaName:参数名称-字符型
'ParaType:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符)
Dim Paravalue
Paravalue=Request(ParaName)
If ParaType=1 then
'添加非空判断 Paravalue=replace(Paravalue,"-","")
If Paravalue="" then
'Response.write "参数" & ParaName & "不能为空！"
Response.Write("<script language='javascript1.2'>history.go(-1)</script>")
Response.end
elseIf not isNumeric(Paravalue) then
'Response.write "参数" & ParaName & "必须为数字型！"
Response.Write("<script language='javascript1.2'>history.go(-1)</script>")
Response.end
End if
Else
Paravalue=replace(Paravalue,"'","''")
End if
SafeRequest=Paravalue
End function
%>
<%
id1 = Request("id")
SafeReplace(id1)
SafeRequest(id1,1)
if Request("id")="" then
response.Write("请输入要查看的的ID")
Else
sql="select * from xy_news where id = "+id1
rs.Open sql,conn,1,3
if rs.EOF then
response.redirect "/"
else
%>