实施修复
思路方法有很多在这里介绍两种咱们使用第2种 思路方法1: Replace过滤
解决思路方法:查找login.asp下
<from找到下边类似 username=request.Form("name")
pass=request.Form("pass")
修改为:
username=Replace(request.Form("name"), "’", "’’")
pass=Replace(request.Form("pass"), "’", "’’")
语法是屏蔽’和’’
来达到效果. 思路方法2:在conn.asp 内加入<!--#
file="safe.asp"--> 注:(前提 登陆页面有<!--#
file="conn.asp"-->) 把以下代码保存为safe.asp
下面是
代码******************************************************** <%
Dim Query_Badword,Form_Badword,i,Err_Message,Err_Web,name
Err_Message = 3
Err_Web = "safe.htm"
’出错时转向
页面 Query_Badword="’|and|select|update|chr|delete|%20from|;|insert|mid|master.|
|chr(37)|=" ’在这部份定义get非法参数,使用"|"号间隔
Form_Badword="’|(|)|;|="
’在这部份定义post非法参数,使用"|"号间隔
On Error Resume Next
request.QueryString<>"" then Chk_badword=split(Query_Badword,"|")
FOR EACH Query_Name IN Request.QueryString
for i=0 to ubound(Chk_badword)
If Instr(LCase(request.QueryString(Query_Name)),Chk_badword(i))<>0 Then
Select Case Err_Message
Case "1"
Response.Write "<Script Language=JavaScript>alert(’传参
！参数 "&name&" 值中包含非法串！\n\n请不要在参数中出现:and update delete ; insert mid master 等非法！’);window.close
;</Script>" Case "2"
Response.Write "<Script Language=JavaScript>location.href=’"&Err_Web&"’</Script>"
Case "3"
Response.Write "<Script Language=JavaScript>alert(’传参
！参数 "&name&"值中包含非法串！\n\n请不要在参数中出现:and update delete ; insert mid master 等非法！’);location.href=’"&Err_Web&"’;</Script>" End Select
Response.End
End If
NEXT
NEXT
End
request.form<>"" then Chk_badword=split(Form_Badword,"|")
FOR EACH name IN Request.Form
for i=0 to ubound(Chk_badword)
If Instr(LCase(request.form(name)),Chk_badword(i))<>0 Then
Select Case Err_Message
Case "1"
Response.Write "<Script Language=JavaScript>alert(’出错了！表单 "&name&"
值中包含非法串！\n\n你非法操作已记录,请马上停止非法行为！’);window.close;</Script>" Case "2"
Response.Write "<Script Language=JavaScript>location.href=’"&Err_Web&"’</Script>"
Case "3"
Response.Write "<Script Language=JavaScript>alert(’唐山味儿不浓 告诉您出错了！参数 "&name&"
值中包含非法串！\n\谢谢您光临！,请停止非法行为！’);location.href=’"&Err_Web&"’;</Script>" End Select
Response.End
End If
NEXT
NEXT
end
%>
篇文章: 修改破解MYSQL密码思路方法大全篇文章: Armadillo变换IAT修复
最新评论