",chr(13)&chr(10)) end function '防止注入函数 Function SafeRequest(ParaName,ParaType) '--- 传入参数 --- 'ParaName:参数名称-字符型 'ParaType:参数类型-数字型(1表示以上参数是数字，0表示以上参数为字符) Dim ParaValue ParaValue=Request(ParaName) If ParaType=1 then If not isNumeric(ParaValue) then 'Response.write "参数" & ParaName & "必须为数字型！" 'Response.end ParaValue=0 End if Else ParaValue=replace(ParaValue,"'","''") End if SafeRequest=ParaValue End function function strLength(str) ON ERROR RESUME NEXT dim WINNT_CHINESE WINNT_CHINESE = (len("论坛")=2) if WINNT_CHINESE then dim l,t,c dim i l=len(str) t=l for i=1 to l c=asc(mid(str,i,1)) if c<0 then c=c+65536 if c>255 then t=t+1 end if next strLength=t else strLength=len(str) end if if err.number<>0 then err.clear end function function cutStr(str,strlen) dim l,t,c l=len(str) t=0 for i=1 to l c=Abs(Asc(Mid(str,i,1))) if c>255 then t=t+2 else t=t+1 end if if t>=strlen then cutStr=left(str,i)&".." exit for else cutStr=str end if next cutStr=replace(cutStr,chr(10),"") end function function DispDate(dt,dmode) if dmode=0 then DispDate=datevalue(dt) elseif dmode=1 then DispDate=month(dt) & "-" & day(dt) elseif dmode=2 then DispDate=month(dt) & "/" & day(dt) elseif dmode=3 then DispDate=right(year(dt),2) &"/" & month(dt) & "/" & day(dt) elseif dmode=4 then DispDate=year(dt) &"年" & month(dt) & "月" & day(dt) &"日" elseif dmode=5 then DispDate=year(dt) &"/" & month(dt) & "/" & day(dt) elseif dmode=6 then DispDate=right("0000"&year(dt),2) &"-" & right("00"&month(dt),2) & "-" & right("00"&day(dt),2)&" "&right("00"&hour(dt),2) &":"& right("00"&minute(dt),2) else DispDate="[" & hour(dt) & ":" & minute(dt) & "]" end if end function Function FormatSQL(strChar) if strChar="" then FormatSQL="" else FormatSQL=replace(replace(replace(replace(replace(replace(replace(replace(strChar,"'","’"),"*","×"),"?","？"),"(","（"),")","）"),"<","〈"),".","。"),";","；") end if End Function %> <% 'Dim N_userip,N_thispage,Err_Message N_userip = Request.ServerVariables("REMOTE_ADDR") N_thispage = LCase(Request.ServerVariables("URL")) Err_Message = 0 '处理方式：1=提示信息,2=转向页面,3=先提示再转向,0=保存至数据库,继续运行 Call CheckRequestStr() Sub CheckRequestStr() Dim Query_Badword,Form_Badword,i,Err_Web,name '------定义部份 头---------------------------------------------------------------------- Err_Web = "Err.Asp" '出错时转向的页面 '在这部份定义get非法参数,使用"∥"号间隔 Query_Badword="'∥and∥select∥update∥chr∥delete∥%20from∥insert∥mid∥master.∥set∥chr(37)∥xp_cmdshell∥net user∥create" '在这部份定义post非法参数,使用"∥"号间隔 'Form_Badword="'" Form_Badword="'∥and∥select∥update∥chr∥delete∥%20from∥insert∥mid∥master.∥set∥chr(37)∥xp_cmdshell∥net user∥create" '------定义部份 尾----------------------------------------------------------------------- 'On Error Resume Next '----- 对 get query 值 的过滤. if request.QueryString<>"" then Chk_badword=split(Query_Badword,"∥") FOR EACH Query_Name IN Request.QueryString for i=0 to ubound(Chk_badword) If Instr(LCase(request.QueryString(Query_Name)),Chk_badword(i))<>0 Then Call CheckData(Chk_badword(i)) End If NEXT NEXT End if '-----对 post 表 单值的过滤. if request.form<>"" then Chk_badword=split(Form_Badword,"∥") FOR EACH name IN Request.Form for i=0 to ubound(Chk_badword) If Instr(LCase(request.form(name)),Chk_badword(i))<>0 Then request.form(name) Call CheckData(Chk_badword(i)) End If NEXT NEXT end if End Sub Sub CheckData(RequestWord) Select Case Err_Message Case "1" Response.Write "" Response.End Case "2" Response.Write "" Response.End Case "3" Response.Write "" Response.End Case "0" if RequestWord="'" then sqlc="select * from CheckRequest where userip='"&N_userip&"' and page='"&GetUrl()&"' and word='’'" else sqlc="select * from CheckRequest where userip='"&N_userip&"' and page='"&GetUrl()&"' and word='"&RequestWord&"' " end if set rs=conn.execute(sqlc) if rs.eof then if RequestWord="'" then sql="insert CheckRequest (userip,page,word,addtime,hit,updatetime) values ('"&N_userip&"','"&GetUrl()&"','’','"&now()&"','0','"&now()&"')" else sql="insert CheckRequest (userip,page,word,addtime,hit,updatetime) values ('"&N_userip&"','"&GetUrl()&"','"&RequestWord&"','"&now()&"','0','"&now()&"')" end if 'response.write sql&"
" conn.execute(sql) else dim checkrequest_hits checkrequest_hits=rs("hit")+1 sqlupdate="update CheckRequest set updatetime='"&now()&"', hit='"&checkrequest_hits&"' where id='"&rs("id")&"'" 'response.write sqlupdate conn.execute(sqlupdate) end if rs.close 'set rs=nothing End Select End Sub '========================= '获取当前Url参数的函数 Private Function GetUrl() Dim ScriptAddress,M_ItemUrl, M_item ScriptAddress = CStr(Request.ServerVariables("SCRIPT_NAME")) '取得当前地址 M_ItemUrl = "" If (Request.QueryString <> "") Then ScriptAddress = ScriptAddress & "?" For Each M_item In Request.QueryString '如果页面传递参数是用page变量，那么判断一下page是否已经使用，避免重复！ If InStr("page",M_Item)=0 Then M_ItemUrl = M_ItemUrl & M_Item &"="& Server.URLEncode(Request.QueryString(""&M_Item&"")) & "&" End If Next end if GetUrl = ScriptAddress & M_ItemUrl if instr(1,GetUrl,"?",1)<1 then GetUrl=GetUrl&"?" end if End Function '============================= %> <% sub mypage(vStr) ''创建表单myform,方法为Get response.write("
|
|
