用户输入过滤程序.asp

较为详细的介绍了asp自定义的各种函数,方便asp的各种开发.

<%
strUserInput="Smith'%;EXEC master..xp_cmdshell 'dir *.exe"
strUserInput=Replace(strUserInput,"<",vbNullString)
strUserInput=Replace(strUserInput,">",vbNullString)
strUserInput=Replace(strUserInput,"""",vbNullString)
strUserInput=Replace(strUserInput,"'",vbNullString)
strUserInput=Replace(strUserInput,"%",vbNullString)
strUserInput=Replace(strUserInput,";",vbNullString)
strUserInput=Replace(strUserInput,"(",vbNullString)
strUserInput=Replace(strUserInput,")",vbNullString)
strUserInput=Replace(strUserInput,"&",vbNullString)
strUserInput=Replace(strUserInput,"+",vbNullString)
strUserInput=Replace(strUserInput,"-",vbNullString)
response.write strUserInput
%>