ASP防注入代码

答案：
<%

Dim GetFlag Rem(提交方式)

Dim ErrorSql Rem(非法字符) 

Dim RequestKey Rem(提交数据)

Dim ForI Rem(循环标记)

ErrorSql = "'~;~and~(~)~exec~update~count~*~%~chr~mid~master~truncate~char~declare" Rem(敏感字符或者词语用半角 "~" 格开)

ErrorSql = split(ErrorSql,"~")

If Request.ServerVariables("REQUEST_METHOD")="GET" Then

GetFlag=True

Else

GetFlag=False

End If

If GetFlag Then

For Each RequestKey In Request.QueryString

For ForI=0 To Ubound(ErrorSql)

If Instr(LCase(Request.QueryString(RequestKey)),ErrorSql(ForI))<>0 Then

response.write "<scrīpt>alert(""警告:\n请不要提交非法参数"");location.href=>
Response.End

End If
[page_break]


Next

Next 

Else

For Each RequestKey In Request.Form

For ForI=0 To Ubound(ErrorSql)

If Instr(LCase(Request.Form(RequestKey)),ErrorSql(ForI))<>0 Then

response.write "<scrīpt>alert(""警告:\n请不要提交非法参数"");location.href=>
Response.End

End If

Next

Next

End If

%>

上一个：HTML：让网页超链接拥有多姿多彩的下划线(1)
下一个：关于or=or漏洞问题简述