asp常用函数

1.放注入函数

sub aspsql() SQL_injdata = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" SQL_inj = split(SQL_Injdata,"|") If Request.Form<>"" Then For Each Sql_Post In Request.Form For SQL_Data=0 To Ubound(SQL_inj) if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then response.write "<mce:script language='javascript'><!-- " response.write "alert('网站安全提示：请不要在参数中包含非法字符！');" response.write "location.href='javascript:history.go(-1)';" response.write " // --></mce:script>" response.end end if next next end if If Request.QueryString<>"" Then For Each SQL_Get In Request.QueryString For SQL_Data=0 To Ubound(SQL_inj) if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then response.write "<mce:script language='javascript'><!-- " response.write "alert('网站安全提示：请不要在参数中包含非法字符！');" response.write "location.href='javascript:history.go(-1)';" response.write " // --></mce:script>" response.end end if next Next end If end sub

2.会员名是否含有汉字

function jc(s) r=true str="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ" for i=1 to len(s) w=mid(s,i,1) if instr(str,w)=0 then r=false end if next jc=r end function

3.过滤字符中的特殊字符

Function inHTML(str) Dim sTemp sTemp = str inHTML = "" If IsNull(sTemp) = True Then Exit Function End If sTemp = Replace(sTemp, "&", "&") sTemp = Replace(sTemp, "<", "<") sTemp = Replace(sTemp, ">", ">") sTemp = Replace(sTemp, Chr(34), """) inHTML = sTemp End Function

4.'拒绝夸站提交代码

function postFormFrom() server_v1=Cstr(Request.ServerVariables("HTTP_REFERER")) server_v2=Cstr(Request.ServerVariables("SERVER_NAME")) if mid(server_v1,8,len(server_v2))<>server_v2 then CuBox "你提交的路径有误，禁止从站点外部提交数据请不要乱该参数！",1,"" response.end end if end function

5.检查无效字符

Function CheckStr(byVal ChkStr) Dim str:Str=ChkStr If IsNull(Str) Then CheckStr = "" Exit Function End If str=trim(str) Dim re Set re=new RegExp re.IgnoreCase =True re.Global=True re.Pattern="(/r/n){3,}" Str=re.Replace(Str,"$1$1$1") Set re=Nothing Str = Replace(Str,"'","’") Str = Replace(Str, "select", "select") Str = Replace(Str, "join", "join") Str = Replace(Str, "union", "union") Str = Replace(Str, "where", "where") Str = Replace(Str, "insert", "insert") Str = Replace(Str, "delete", "delete") Str = Replace(Str, "update", "update") Str = Replace(Str, "like", "like") Str = Replace(Str, "drop", "drop") Str = Replace(Str, "create", "create") Str = Replace(Str, "modify", "modify") Str = Replace(Str, "rename", "rename") Str = Replace(Str, "alter", "alter") Str = Replace(Str, "cast", "cast") CheckStr=Str End Function

6.验证Email

function IsValidEmail(email) dim names, name, i, c IsValidEmail = true names = Split(email, "@") if UBound(names) <> 1 then IsValidEmail = false exit function end if for each name in names if Len(name) <= 0 then IsValidEmail = false exit function end if for i = 1 to Len(name) c = Mid(name, i, 1) if InStr("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-.", c) <= 0 and not IsNumeric(c) then IsValidEmail = false exit function end if next if Left(name, 1) = "." or Right(name, 1) = "." then IsValidEmail = false exit function end if next if InStr(names(1), ".") <= 0 then IsValidEmail = false exit function end if i = Len(names(1)) - InStrRev(names(1), ".") if i <> 2 and i <> 3 then IsValidEmail = false exit function end if if InStr(email, "..") > 0 then IsValidEmail = false end if end function

7.用户IP

'取得用户IP Public Function GetIP() Dim strIPAddr If Request.ServerVariables("HTTP_X_FORWARDED_FOR") = "" OR InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), "unknown") > 0 Then strIPAddr = Request.ServerVariables("REMOTE_ADDR") ElseIf InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ",") > 0 Then strIPAddr = Mid(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), 1, InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ",")-1) Actforip=Request.ServerVariables("REMOTE_ADDR") ElseIf InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ";") > 0 Then strIPAddr = Mid(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), 1, InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ";")-1) Actforip=Request.ServerVariables("REMOTE_ADDR") Else strIPAddr = Request.ServerVariables("HTTP_X_FORWARDED_FOR") Actforip=Request.ServerVariables("REMOTE_ADDR") End If GetIP = CheckStr(Trim(Mid(strIPAddr, 1, 30))) End Function '显示部分IP地址 function Ck(ip) Ck=mid(ip,1,instrRev(ip,"."))&"*" end function

8.格式化日期

Function FormatDate(DateAndTime, Format) On Error Resume Next Dim yy,y, m, d, h, mi, s, strDateTime FormatDate = DateAndTime If Not IsNumeric(Format) Then Exit Function If Not IsDate(DateAndTime) Then Exit Function yy = CStr(Year(DateAndTime)) y = Mid(CStr(Year(DateAndTime)),3) m = CStr(Month(DateAndTime)) If Len(m) = 1 Then m = "0" & m d = CStr(Day(DateAndTime)) If Len(d) = 1 Then d = "0" & d h = CStr(Hour(DateAndTime)) If Len(h) = 1 Then h = "0" & h mi = CStr(Minute(DateAndTime)) If Len(mi) = 1 Then mi = "0" & mi s = CStr(Second(DateAndTime)) If Len(s) = 1 Then s = "0" & s Select Case Format Case "1" strDateTime = y & "-" & m & "-" & d & " " & h & ":" & mi & ":" & s Case "2" strDateTime = yy & m & d & h & mi & s '返回12位 直到秒 的时间字符串 Case "3" strDateTime = yy & m & d & h & mi '返回12位 直到分 的时间字符串 Case "4" strDateTime = yy & "年" & m & "月" & d & "日" Case "5" strDateTime = m & "-" & d Case "6" strDateTime = m & "/" & d Case "7" strDateTime = m & "月" & d & "日" Case "8" strDateTime = y & "年" & m & "月" Case "9" strDateTime = y & "-" & m Case "10" strDateTime = y & "/" & m Case "11" strDateTime = y & "-" & m & "-" & d Case "12" strDateTime = y & "/" & m & "/" & d Case "13" strDateTime = yy & "." & m & "." & d Case "14" strDateTime = yy & "/" & m & "/" & d Case "15" strDateTime = yy & "-" & m & "-" & d Case Else strDateTime = DateAndTime End Select FormatDate = strDateTime End Function

9.过滤sql函数

Function SqlIn(Str) If Isnull(Str) Then SqlIn = "" Exit Function End If Str=trim(Str) Str = Replace(Str,Chr(0),"", 1, -1, 1) Str = Replace(Str, """", """, 1, -1, 1) Str = Replace(Str,"<","<", 1, -1, 1) Str = Replace(Str,">",">", 1, -1, 1) Str = Replace(Str, "script", "script", 1, -1, 0) Str = Replace(Str, "SCRIPT", "SCRIPT", 1, -1, 0) Str = Replace(Str, "Script", "Script", 1, -1, 0) Str = Replace(Str, "script", "Script", 1, -1, 1) Str = Replace(Str, "object", "object", 1, -1, 0) Str = Replace(Str, "OBJECT", "OBJECT", 1, -1, 0) Str = Replace(Str, "Object", "Object", 1, -1, 0) Str = Replace(Str, "object", "Object", 1, -1, 1) Str = Replace(Str, "applet", "applet", 1, -1, 0) Str = Replace(Str, "APPLET", "APPLET", 1, -1, 0) Str = Replace(Str, "Applet", "Applet", 1, -1, 0) Str = Replace(Str, "applet", "Applet", 1, -1, 1) Str = Replace(Str, "[", "[") Str = Replace(Str, "]", "]") Str = Replace(Str, """", "", 1, -1, 1) Str = Replace(Str, "=", "=", 1, -1, 1) Str = Replace(Str, "'", "''", 1, -1, 1) Str = Replace(Str, "select", "select", 1, -1, 1) Str = Replace(Str, "execute", "execute", 1, -1, 1) Str = Replace(Str, "exec", "exec", 1, -1, 1) Str = Replace(Str, "join", "join", 1, -1, 1) Str = Replace(Str, "union", "union", 1, -1, 1) Str = Replace(Str, "where", "where", 1, -1, 1) Str = Replace(Str, "insert", "insert", 1, -1, 1) Str = Replace(Str, "delete", "delete", 1, -1, 1) Str = Replace(Str, "update", "update", 1, -1, 1) Str = Replace(Str, "like", "like", 1, -1, 1) Str = Replace(Str, "drop", "drop", 1, -1, 1) Str = Replace(Str, "create", "create", 1, -1, 1) Str = Replace(Str, "rename", "rename", 1, -1, 1) Str = Replace(Str, "count", "count", 1, -1, 1) Str = Replace(Str, "chr", "chr", 1, -1, 1) Str = Replace(Str, "mid", "mid", 1, -1, 1) Str = Replace(Str, "truncate", "truncate", 1, -1, 1) Str = Replace(Str, "nchar", "nchar", 1, -1, 1) Str = Replace(Str, "char", "char", 1, -1, 1) Str = Replace(Str, "alter", "alter", 1, -1, 1) Str = Replace(Str, "cast", "cast", 1, -1, 1) Str = Replace(Str, "exists", "exists", 1, -1, 1) Str = Replace(Str,Chr(13),"<br>", 1, -1, 1) SqlIn = Replace(Str,"'","''", 1, -1, 1) End Function