加入收藏 | 设为首页 | 会员中心 | 我要投稿 佛山站长网 (https://www.0757zz.com/)- 科技、建站、经验、云计算、5G、大数据,站长网!
当前位置: 首页 > 站长学院 > Asp教程 > 正文

EasyASP v2.2新功能介绍(1):Easp是如何实现防sql注入的

发布时间:2016-10-08 21:26:29 所属栏目:Asp教程 来源:网络整理
导读:EasyASP终于到v2.2了,目前还在完善手册,群里有很多人问如何使用的问题 ,所以打算在写手册的同时写一些新功能的介绍,方便使用Easp 的童鞋们快速 进入状态。

4.核心代码

以下是处理程序的核心代码,其它的具体代码,可以下载EasyASP v2.2 Alpha的源文件查看。

(其中的CLeft,CRight,IsN,Has,Use等方法均为Easp的内建方法,请阅读完整 源码了解其含义。另外,从下面的源码中也可以看到2.2的另一些新功能,比如 支持伪URL Rewrite和Cookies的AES算法加密,以后我会陆续介绍。)

'取QueryString值,支持取Rewrite值
Function [Get](Byval s)
     Dim tmp, i, arrQs, t
     If Instr(s,":")>0 Then
     '如果有类型参数,则取出为t
         t = CRight(s,":") : s = CLeft(s,":")
     End If
     If isRewrite Then
     '如果是Rewrite的页面地址
         arrQs = Split(s_rwtU,"&")
         For i = 0 To Ubound(arrQs)
             If s = CLeft(arrQs(i),"=") Then
                 tmp = RegReplace (s_url,s_rwtS,CRight(arrQs(i),"="))
                 Exit For
             End If
         Next
     Else
     '否则直接取QueryString
         tmp = Request.QueryString(s)
     End If
     [Get] = Safe(tmp,t)
End Function
'取Form值
Function Post(ByVal s)
     Dim t,tmp
     If Instr(s,":")>0 Then
         t = CRight(s,":") : s = CLeft(s,":")
     End If
     tmp = Request.Form(s)
     Post = Safe(tmp,t)
End Function
'取Cookies值
Function Cookie(ByVal s)
     Dim p,t,coo
     If Instr(s,">") > 0 Then
         p = CLeft(s,">")
         s = CRight(s,">")
     End If
     If Instr(s,":")>0 Then
         t = CRight(s,":")
         s = CLeft(s,":")
     End If
     If Has(p) And Has(s) Then
         If Response.Cookies(p).HasKeys Then
             coo = Request.Cookies(p)(s)
         End If
     ElseIf Has(s) Then
         coo = Request.Cookies(s)
     Else
         Cookie = "" : Exit Function
     End If
     If IsN(coo) Then Cookie = "": Exit Function
     If  b_cooen Then
         Use("Aes") : coo = Aes.Decode(coo)
     End If
     Cookie = Safe(coo,t)
End Function
'安全获取值基础方法
Function Safe(ByVal s, ByVal t)
     Dim spl,d,l,li,i,tmp,arr() : l = False
     '如果类型中有默认值
     If Instr(t,":")>0 Then
         d = CRight(t,":") : t = CLeft(t,":")
     End If
     If Instr(",sa,da,na,se,de,ne,", "," & Left(LCase (t),2) & ",")>0 Then
         '如果有分隔符且要警告
         If Len(t)>2 Then
             spl = Mid(t,3) : t = LCase(Left(t,2))  : l = True
         End If
     ElseIf Instr("sdn", Left(LCase(t),1))>0 Then
         '如果有分隔符且不警告
         If Len(t)>1 Then
             spl = Mid(t,2) : t = LCase(Left(t,1))  : l = True
         End If
     ElseIf Has(t) Then
         '仅有分隔符无类型
         spl = t : t = "" : l = True
     End If
     li = Split(s,spl)
     If l Then Redim arr(Ubound(li))
     For i = 0 To Ubound(li)
         If i<>0 Then tmp = tmp & spl
         Select Case t
             Case "s","sa","se"
             '字符串类型
                 If isN(li(i)) Then li(i) =  d
                 tmp = tmp & Replace(li (i),"'","''")
                 If l Then arr(i) = Replace(li (i),"'","''")
             Case "d","da","de"
             '日期类型
                 If t = "da" Then
                     If Not isDate(li(i)) And  Has(li(i)) Then Alert("不正确的日期值!")
                 ElseIf t = "de" Then
                     If Not isDate(li(i)) And  Has(li(i)) Then [error].Throw("不正确的日期值!")
                 End If
                 tmp = IIF(isDate(li(i)), tmp  & li(i), tmp & d)
                 If l Then arr(i) = IIF(isDate (li(i)), li(i), d)
             Case "n","na","ne"
             '数字类型
                 If t = "na" Then
                     If Not isNumeric(li(i))  And Has(li(i)) Then Alert("不正确的数值!")
                 ElseIf t = "ne" Then
                     If Not isNumeric(li(i))  And Has(li(i)) Then [error].Throw("不正确的数值!")
                 End If
                 tmp = IIF(isNumeric(li(i)), tmp  & li(i), tmp & d)
                 If l Then arr(i) = IIF (isNumeric(li(i)), li(i), d)
             Case Else
             '未指定类型则不处理
                 tmp = IIF(isN(li(i)), tmp &  d, tmp & li(i))
                 If l Then arr(i) = IIF(isN(li (i)), d, li(i))
         End Select
     Next
     Safe = IIF(l,arr,tmp)

End Function

(编辑:佛山站长网)

【声明】本站内容均来自网络,其相关言论仅代表作者个人观点,不代表本站立场。若无意侵犯到您的权利,请及时与联系站长删除相关内容!

热点阅读