求过滤危险代码的函数？

[ihope6]

全部过滤就会，不用UBB，之过滤危险代码的函数谁有？

比如script , onclick , <isindex type=image src=1 onerror=alert(1)>等

而保留一些常用的代码比如css,hr br table 等等。

[dengchenlu]

UP

[alex_zs]

<%
'防止本地提交
Sub Chkhttp()
Dim url1,url2
url1 = Cstr(Request.ServerVariables("HTTP_REFERER"))
url2 = Cstr(Request.ServerVariables("SERVER_NAME"))
If Mid(url1,8,Len(url2))<>url2 Then
	Response.Write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=250>"
	Response.Write "<tr><td style=font:9pt Verdana>"
	Response.Write "不会吧，老兄，提交方式不太对哟！"
	Response.Write "</td></tr></table></center>"
	Response.End
End If
End Sub
%>
<%
'防止URL地址注入
Sub URLSQL()
ThisUEL=Request.ServerVariables("SERVER_NAME")
If InStr(ThisURL,"'") or InStr(ThisURL,"or") or InStr(ThisURL,"select") or InStr(ThisURL,"and") or InStr(ThisURL,"from") or InStr(ThisURL,"where") Then
	Response.Write "<br><br><center><table border=1 cellpadding=20 bordercolor=black bgcolor=#EEEEEE width=250>"
	Response.Write "<tr><td style=font:9pt Verdana>"
	Response.Write "So Sorry！您的页面提交方式似乎不正确！"
	Response.Write "</td></tr></table></center>"
	Response.End
End If
End sub
%>
<%
'过滤SQL字符(表单)
Function BadName(StrChar)
If IsNull(StrChar) or StrChar="" Then
	BadName=""
Else
	BadName = Replace(StrChar, "'", "")
	BadName = Replace(StrChar, "*", "")
	BadName = Replace(StrChar, "?", "")
	BadName = Replace(StrChar, "(", "")
	BadName = Replace(StrChar, ")", "")
	BadName = Replace(StrChar, "<", "")
	BadName = Replace(StrChar, ">", "")
	BadName = Replace(StrChar, ".", "")
	BadName = Replace(StrChar, ";", "")
	BadName = Replace(StrChar, "#", "")
	BadName = Replace(StrChar, "%", "")
End If
End Function
%>
<%
'过滤SQL危险字符2
Function sqlstr(data)  '替换字符串
	data = Trim(Replace(Request.Form(data),"&","&"))
	data = Replace(data,"<","<")
	data = Replace(data,">",">")
	data = Replace(data,"'","""")
	data = Replace(data,"*","")
	data = Replace(data,"?","")
	data = Replace(data,"select","")
	data = Replace(data,"insert","")
	data = Replace(data,"delete","")
	data = Replace(data,"update","")
	data = Replace(data,"delete","")
	data = Replace(data,"create","")
	data = Replace(data,"drop","")
	data = Replace(data,"declare","")
	data = Replace(data,vbCrLf&vbCrlf,"</p><p>")
	data = Replace(data,vbCrLf,"<br>")
	sqlstr = Replace(data,"  "," ")
End Function
%>

[ppp7p]

过滤非法字符是一块，另外程序里面最好用参数和存储过程。

[ihope6]

个人感觉alex_zs兄的代码不行，

因为：比如技术论坛肯定要允许别人发代码，你都过滤掉了，怎么行呢？

[ihope6]

有人回答吗，论坛的发帖是怎么做的呢？

论坛可以发布任何信息。而且过滤了危险代码

[zlb789]

关注下

[ihope6]

这个功能应该应用很广呀，如果有人能做出调用的函数就好了。

[winner2050]

压根就不应该給人家用.

CSS 也执行js的.

table 也很可怕.如果有个家伙无聊,设置一个超宽超高的table ,其他人也被波及.

[ihope6]

winner2050说的有道理！

[liujiayu10]

//防注入攻击类
public class ProcessRequest
{
public static void StartProcessRequest()
{
string sqlErrorPage = "ErrorPage.htm";
try
{
string getkeys = "";
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int i = 0; i < System.Web.HttpContext.Current.Request.QueryString.Count; i++)
{
getkeys = System.Web.HttpContext.Current.Request.QueryString.Keys[i];
if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.QueryString[getkeys]))
{
System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage + "");
System.Web.HttpContext.Current.Response.End();
}
}
}
if (System.Web.HttpContext.Current.Request.Form != null)
{
for (int i = 0; i < System.Web.HttpContext.Current.Request.Form.Count; i++)
{
getkeys = System.Web.HttpContext.Current.Request.Form.Keys[i];
if (!ProcessSqlStr(System.Web.HttpContext.Current.Request.Form[getkeys]))
{
System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage + "");
System.Web.HttpContext.Current.Response.End();
}
}
}
}
catch
{
System.Web.HttpContext.Current.Response.Redirect(sqlErrorPage + "");
System.Web.HttpContext.Current.Response.End();
}
}

public static bool ProcessSqlStr(string Str)
{
bool ReturnValue = true;
try
{
if (Str != "")
{
string SqlStr = ";|and|exec|insert|select|delete|update|count|*|chr|mid|master|truncate|char|declare";
string[] anySqlStr = SqlStr.Split('|');
foreach (string s in anySqlStr)
{
if (Str.IndexOf(s) > -1)
{
ReturnValue = false;
}
}
}
}
catch
{
ReturnValue = false;
}
return ReturnValue;
}
}

[liuyeede]

mark！

[kfps8kfps8]

mark！

[超级菜菜菜菜]

[Quote=引用 10 楼 liujiayu10 的回复:]
//防注入攻击类
public class ProcessRequest
{
public static void StartProcessRequest()
{
string sqlErrorPage = "ErrorPage.htm";
try
{
string getkeys = "";
if (System.Web.HttpContext.Current.Request.QueryString != null)
{
for (int i = 0; i < System.W…
[/Quote]

收藏了，谢谢！！！