ASP安全写入数据库操作，正常读出并显示在不同的场合

<%Function fn_chk_to_html(Str)
'如<input text="<%=request("styledesc")%>">的情况下
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = Replace(Str, Chr(0), "",1,-1,1)
 Str = Replace(Str, """", "&quot;",1,-1,1)
 Str = Replace(Str, "'", "&#039;",1,-1,1)
 Str = Replace(Str, "<","&lt;",1,-1,1)
 Str = Replace(Str, ">","&gt;",1,-1,1)
 Str = Replace(Str, vbCrlf, "<br>",1,-1,1)
 fn_chk_to_html = Str
End Function
%>

<%Function fn_chk_to_script(Str)
'如 response.write "<script>alert('"&request("styledesc")&"');</script>"的情况下
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = Replace(Str, "\", "\\",1,-1,1)
 Str = Replace(Str, """", "\""",1,-1,1)
 Str = Replace(Str, "'", "\'",1,-1,1)
 Str = Replace(Str,Chr(13),"\n",1,-1,1)
 fn_chk_to_script = Str
End Function
%>
<%
Function fn_chk_to_sql_mark(Str)
'如 sql="select * from style where styledesc like '"&request("styledesc")&"'"的情况下
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = Replace(Str, "'", "''",1,-1,1)
 fn_chk_to_sql_mark = Str
End Function
%>

<%Function fn_chk_to_sql_go(Str)
'如sql = "select * from "&request("table")的情况下.??
 If Isnull(Str) Then
  ChkSql = ""
  Exit Function
 End If
 Str = trim(Str)
 Str = Replace(Str, Chr(0), "",1,-1,1)
 Str = Replace(Str, """", "&quot;",1,-1,1)
 Str = Replace(Str, "'", "&#039;",1,-1,1)

[1] [2] 下一页

复制本页网址和标题，发送给你QQ/Msn的好友一起分享

上一篇:ASP中怎么添加验证码的解决方法

下一篇:在asp中access与sqlserver查询的不同