ASP登陆验证页应做的安全问题
应对ASP溢出漏洞我们应该做全面的字符过滤
一种是会员登陆
下面这一段代码是把username的非法字符过滤掉
<%
username=trim(request.form("username"))
userpws=trim(request.form("password"))
if username="" or userpws="" or Instr(username,"=")0 or Instr(username,"%")0 or Instr(username,chr(32))0 or Instr(username,"?")0 or Instr(username,"&")0 or Instr(username,";")0 or Instr(username,",")0 or Instr(username,"'")0 or Instr(username,",")0 or Instr(username,chr(34))0 or Instr(username,chr(9))0 or Instr(username,"")0 or Instr(username,"$")0 then
response.write('' 请正确...[ 查看全文 ]
2016-01-29
标签:
