ASP防XSS注入函数技巧
2016-07-11 08:26
537 查看
'*************************************
'防XSS注入函数 更新于2009-04-21 by evio
'与checkstr()相比, checkxss更加安全
'*************************************
Function Checkxss(byVal ChkStr)
Dim Str
Str = ChkStr
If IsNull(Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace(Str, "&", "&")
Str = Replace(Str, "'", "´")
Str = Replace(Str, """", """)
Str = Replace(Str, "<", "<")
Str = Replace(Str, ">", ">")
Str = Replace(Str, "/", "/")
Str = Replace(Str, "*", "*")
Dim re
Set re = New RegExp
re.IgnoreCase = True
re.Global = True
re.Pattern = "(w)(here)"
Str = re.Replace(Str, "$1here")
re.Pattern = "(s)(elect)"
Str = re.Replace(Str, "$1elect")
re.Pattern = "(i)(nsert)"
Str = re.Replace(Str, "$1nsert")
re.Pattern = "(c)(reate)"
Str = re.Replace(Str, "$1reate")
re.Pattern = "(d)(rop)"
Str = re.Replace(Str, "$1rop")
re.Pattern = "(a)(lter)"
Str = re.Replace(Str, "$1lter")
re.Pattern = "(d)(elete)"
Str = re.Replace(Str, "$1elete")
re.Pattern = "(u)(pdate)"
Str = re.Replace(Str, "$1pdate")
re.Pattern = "(s)(or)"
Str = re.Replace(Str, "$1or")
re.Pattern = "(n)"
Str = re.Replace(Str, "$1or")
'----------------------------------
re.Pattern = "(java)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(j)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(vb)(script)"
Str = re.Replace(Str, "$1script")
'----------------------------------
If Instr(Str, "exPRession") > 0 Then
Str = Replace(Str, "expression", "expression", 1, -1, 0) '防止xss注入
End If
Set re = Nothing
Checkxss = Str
End Function
'防XSS注入函数 更新于2009-04-21 by evio
'与checkstr()相比, checkxss更加安全
'*************************************
Function Checkxss(byVal ChkStr)
Dim Str
Str = ChkStr
If IsNull(Str) Then
CheckStr = ""
Exit Function
End If
Str = Replace(Str, "&", "&")
Str = Replace(Str, "'", "´")
Str = Replace(Str, """", """)
Str = Replace(Str, "<", "<")
Str = Replace(Str, ">", ">")
Str = Replace(Str, "/", "/")
Str = Replace(Str, "*", "*")
Dim re
Set re = New RegExp
re.IgnoreCase = True
re.Global = True
re.Pattern = "(w)(here)"
Str = re.Replace(Str, "$1here")
re.Pattern = "(s)(elect)"
Str = re.Replace(Str, "$1elect")
re.Pattern = "(i)(nsert)"
Str = re.Replace(Str, "$1nsert")
re.Pattern = "(c)(reate)"
Str = re.Replace(Str, "$1reate")
re.Pattern = "(d)(rop)"
Str = re.Replace(Str, "$1rop")
re.Pattern = "(a)(lter)"
Str = re.Replace(Str, "$1lter")
re.Pattern = "(d)(elete)"
Str = re.Replace(Str, "$1elete")
re.Pattern = "(u)(pdate)"
Str = re.Replace(Str, "$1pdate")
re.Pattern = "(s)(or)"
Str = re.Replace(Str, "$1or")
re.Pattern = "(n)"
Str = re.Replace(Str, "$1or")
'----------------------------------
re.Pattern = "(java)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(j)(script)"
Str = re.Replace(Str, "$1script")
re.Pattern = "(vb)(script)"
Str = re.Replace(Str, "$1script")
'----------------------------------
If Instr(Str, "exPRession") > 0 Then
Str = Replace(Str, "expression", "expression", 1, -1, 0) '防止xss注入
End If
Set re = Nothing
Checkxss = Str
End Function
相关文章推荐
- 使用ASP.NET 2.0 GridView轻松操作数据
- ASP.NET 2.0 GridView控件说明
- Raspberry Pi 3安装配置Raspbian过程
- Spring--Aop-AspectJ
- win10下ASP.NET Core部署环境搭建步骤
- ASP.NET 文件压缩解压类(C#)
- ASP.NET自带对象JSON字符串与实体类的转换
- ASP.NET中Ajax怎么使用
- ASP.NET Core 小应用 on Ubuntu 16.04
- 使用Visual Studio Code开发Asp.Net Core WebApi学习笔记(二)-- Web Api Demo
- win10下iis部署asp.net core rtm
- Could not instnested exception is java.lang.NoClassDefFoundError: org/aspectj/lang/annotation/Around
- ASP.NET Core重写个人博客站点小结
- ASP.NET页面之间传递值的几种方式
- Spring配置项之<aop:aspectj-autoproxy />
- asp.net中,用Ajax实现客户端调用服务器端的函数(PageMethods)
- SpringMVC+Jasperreports出现的java.lang.NoSuchMethodError问题
- ASP.NET + SqlSever 大数据解决方案 PK HADOOP
- 在树莓派上安装GUI的FreeRadius(Raspberry PI based FreeRadius Server with GUI)
- Asp.net-不能在DropDownList中选择多个项