2014年8月18日 星期一

sql injection






<%
Response.ExpiresAbsolute = Now() - 1
Response.Buffer = True
Response.Expires = 0
Response.cacheControl="no cache"
Function FRequest(ByVal ChkStr) 

Dim Str 
Str = Trim(Request(ChkStr)) 

If IsNull(Str) Then 
FRequest = "" 
Exit Function 
End If 

Dim re 
Set re = new RegExp 
re.IgnoreCase = True 
re.Global = True 
re.Pattern = "(\r\n){3,}" 
Str = re.Replace(Str,"$1$1$1") 
Set re = Nothing 

Str = Replace(Str,"'","''") 
Str = Replace(Str, "--", "&#45;&#45;")    
Str = Replace(Str, "/*", "&#47;&#42;")    
Str = Replace(Str, "*/", "&#42;&#47;")    
Str = Replace(Str, "select", "sel&#101;ct") 
Str = Replace(Str, "join", "jo&#105;n") 
Str = Replace(Str, "union", "un&#105;on") 
Str = Replace(Str, "where", "wh&#101;re") 
Str = Replace(Str, "insert", "ins&#101;rt") 
Str = Replace(Str, "delete", "del&#101;te") 
Str = Replace(Str, "update", "up&#100;ate") 
Str = Replace(Str, "like", "lik&#101;") 
Str = Replace(Str, "drop", "dro&#112;") 
Str = Replace(Str, "create", "cr&#101;ate") 
Str = Replace(Str, "modify", "mod&#105;fy") 
Str = Replace(Str, "rename", "ren&#097;me") 
Str = Replace(Str, "alter", "alt&#101;r") 
Str = Replace(Str, "cast", "ca&#115;t") 
Str = Replace(Str, "ASPSESSIONIDCCDDTASQ", "") 
Str = Replace(Str, "ASPSESSIONIDCACATBSQ", "") 
FRequest = Str 

End Function
on error resume next
%>
<!-- #include file="../admin/setting/conn.asp"-->

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html lang="zh-TW">
<head>




程式 : cat, pda ,timesheet01.asp

沒有留言:

張貼留言