 |
|
|
 首页 |
名片设计 CorelDRAW Illustrator AuotoCAD Painter 其他软件 Photoshop Fireworks Flash |
|
比如说有styledesc这个字段,数据要求的是50位,char形,可不可以只限制他50位,其它的不限制, 输入什么字符都可以的.只要是char形,只要数据库答应就行 这样,安全写入数据库操作,正常读出并显示在不同的场合,应用. 应该是怎样做呢? 下面是我总结的几点.异常有可能不对,请指正. 假如对用户的输入是可以任意字符,(除了某字段特定的输入限制条件,如输入长度,输入类型==). 就是输入尽可能不作限制. 对一字符串str,他输出的方向有以下几种: 1.输出至HTML中,Function fn_chk_to_html(Str) 2.输出至Script中(如javascript),Function fn_chk_to_script(Str) 3.输出至sql语句中,而且这条SQL语句是用\\\'\\\'两个单引括起字符串Str的. Function fn_chk_to_sql_mark(Str) 4.输出至sql语句中,而且这条SQL语句是没有用单引括起Str的.Function fn_chk_to_sql_go(Str) 5.输出至URL .Function fn_chk_to_url(Str) <%Function fn_chk_to_html(Str) \\\'如<input text="<%=request("styledesc")%>">的情况下 If Isnull(Str) Then ChkSql = "" Exit Function End If Str = trim(Str) Str = Replace(Str, Chr(0), "",1,-1,1) Str = Replace(Str, """", """,1,-1,1) Str = Replace(Str, "\\\'", "'",1,-1,1) Str = Replace(Str, "<","<",1,-1,1) Str = Replace(Str, ">",">",1,-1,1) Str = Replace(Str, vbCrlf, "<br>",1,-1,1) fn_chk_to_html = Str End Function %> <%Function fn_chk_to_script(Str) \\\'如 response.write "<script>alert(\\\'"&request("styledesc")&"\\\');</script>"的情况下 If Isnull(Str) Then ChkSql = "" Exit Function End If Str = trim(Str) Str = Replace(Str, "", "\\",1,-1,1) Str = Replace(Str, """", """",1,-1,1) Str = Replace(Str, "\\\'", "\\\'",1,-1,1) Str = Replace(Str,Chr(13),"n",1,-1,1) fn_chk_to_script = Str End Function %> <% Function fn_chk_to_sql_mark(Str) \\\'如 sql="select * from style where styledesc like \\\'"&request("styledesc")&"\\\'"的情况下 If Isnull(Str) Then ChkSql = "" Exit Function End If Str = trim(Str) Str = Replace(Str, "\\\'", "\\\'\\\'",1,-1,1) fn_chk_to_sql_mark = Str End Function %> <%Function fn_chk_to_sql_go(Str) \\\'如sql = "select * from "&request("table")的情况下.?? If Isnull(Str) Then ChkSql = "" Exit Function End If Str = trim(Str) Str = Replace(Str, Chr(0), "",1,-1,1) Str = Replace(Str, """", """,1,-1,1) Str = Replace(Str, "\\\'", "'",1,-1,1) Str = Replace(Str, "<","<",1,-1,1) Str = Replace(Str, ">",">",1,-1,1) Str = Replace(Str, "[", "[",1,-1,1) Str = Replace(Str, "]", "]",1,-1,1) Str = Replace(Str, "", "\",1,-1,1) Str = Replace(Str, "*", "*",1,-1,1) Str = Replace(Str, "%", "%",1,-1,1) Str = Replace(Str, ";", ";",1,-1,1) Str = Replace(Str, vbCrlf, "<br>",1,-1,1) Str = Replace(Str, "--", "--") fn_chk_to_sql_go = Str End Function %> <%Function fn_chk_to_url(Str) \\\'如 str="<img src=\\\'showimg.asp?id="&request("id")&"\\\'>"的情况下 If Isnull(Str) Then ChkSql = "" Exit Function End If Str = trim(Str) Str = server.URLEncode(Str) fn_chk_to_sql_mark = Str End Function %> 返回类别: 教程 上一教程: ASP编码优化 下一教程: FLASH+ASP打造调查结果 您可以阅读与"ASP,安全写入数据库操作,正常读出并显示在不同的场合"相关的教程: · ASP安全写入数据库操作，正常读出并显示在不同的场合 · 如何做一个高效的ASP数据库操作程序 · 使用组件封装ASP的数据库操作 · 从ACCESS数据库恢复BMP图像并显示在WEB页面(MICROSOFT) · ASP中数据库操作中游标和加锁方法 |
  |
| 快精灵印艺坊 版权所有 |
首页 会员中心在线印刷在线编辑付款方式索取样品设计指南连锁门店
|
||
