asp常用函数

1.放注入函数

sub aspsql()SQL_injdata = "'|;|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare"SQL_inj = split(SQL_Injdata,"|")If Request.Form<>"" ThenFor Each Sql_Post In Request.FormFor SQL_Data=0 To Ubound(SQL_inj)if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Thenresponse.write "<mce:script language='javascript'><!--"response.write "alert('网站安全提示：请不要在参数中包含非法字符！');"response.write "location.href='javascript:history.go(-1)';"response.write "// --></mce:script>"response.endend ifnextnextend ifIf Request.QueryString<>"" ThenFor Each SQL_Get In Request.QueryStringFor SQL_Data=0 To Ubound(SQL_inj)if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Thenresponse.write "<mce:script language='javascript'><!--"response.write "alert('网站安全提示：请不要在参数中包含非法字符！');"response.write "location.href='javascript:history.go(-1)';"response.write "// --></mce:script>"response.endend ifnextNextend Ifend sub

2.会员名是否含有汉字

function jc(s) r=true str="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIGKLMNOPQRSTUVWXYZ" for i=1 to len(s) w=mid(s,i,1) if instr(str,w)=0 then r=false end if next jc=rend function

3.过滤字符中的特殊字符

Function inHTML(str)Dim sTempsTemp = strinHTML = ""If IsNull(sTemp) = True ThenExit FunctionEnd IfsTemp = Replace(sTemp, "&", "&")sTemp = Replace(sTemp, "<", "<")sTemp = Replace(sTemp, ">", ">")sTemp = Replace(sTemp, Chr(34), """)inHTML = sTempEnd Function

4.'拒绝夸站提交代码

function postFormFrom() server_v1=Cstr(Request.ServerVariables("HTTP_REFERER")) server_v2=Cstr(Request.ServerVariables("SERVER_NAME")) if mid(server_v1,8,len(server_v2))<>server_v2 then CuBox "你提交的路径有误，禁止从站点外部提交数据请不要乱该参数！",1,"" response.end end if end function

5.检查无效字符

Function CheckStr(byVal ChkStr) Dim str:Str=ChkStrIf IsNull(Str) ThenCheckStr = ""Exit Function End Ifstr=trim(str)Dim reSet re=new RegExpre.IgnoreCase =Truere.Global=Truere.Pattern="(/r/n){3,}"Str=re.Replace(Str,"$1$1$1")Set re=NothingStr = Replace(Str,"'","’")Str = Replace(Str, "select", "select")Str = Replace(Str, "join", "join")Str = Replace(Str, "union", "union")Str = Replace(Str, "where", "where")Str = Replace(Str, "insert", "insert")Str = Replace(Str, "delete", "delete")Str = Replace(Str, "update", "update")Str = Replace(Str, "like", "like")Str = Replace(Str, "drop", "drop")Str = Replace(Str, "create", "create")Str = Replace(Str, "modify", "modify")Str = Replace(Str, "rename", "rename")Str = Replace(Str, "alter", "alter")Str = Replace(Str, "cast", "cast")CheckStr=StrEnd Function

6.验证Email

function IsValidEmail(email) dim names, name, i, c IsValidEmail = true names = Split(email, "@") if UBound(names) <> 1 then IsValidEmail = false exit function end if for each name in namesif Len(name) <= 0 then IsValidEmail = false exit function end if for i = 1 to Len(name) c = Mid(name, i, 1) if InStr("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-.", c) <= 0 and not IsNumeric(c) then IsValidEmail = false exit function end ifnextif Left(name, 1) = "." or Right(name, 1) = "." then IsValidEmail = false exit function end if next if InStr(names(1), ".") <= 0 then IsValidEmail = false exit function end if i = Len(names(1)) - InStrRev(names(1), ".") if i <> 2 and i <> 3 then IsValidEmail = false exit function end if if InStr(email, "..") > 0 then IsValidEmail = false end ifend function

7.用户IP

'取得用户IPPublic Function GetIP()Dim strIPAddr If Request.ServerVariables("HTTP_X_FORWARDED_FOR") = "" OR InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), "unknown") > 0 Then strIPAddr = Request.ServerVariables("REMOTE_ADDR") ElseIf InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ",") > 0 Then strIPAddr = Mid(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), 1, InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ",")-1) Actforip=Request.ServerVariables("REMOTE_ADDR")ElseIf InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ";") > 0 Then strIPAddr = Mid(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), 1, InStr(Request.ServerVariables("HTTP_X_FORWARDED_FOR"), ";")-1)Actforip=Request.ServerVariables("REMOTE_ADDR")Else strIPAddr = Request.ServerVariables("HTTP_X_FORWARDED_FOR") Actforip=Request.ServerVariables("REMOTE_ADDR")End If GetIP = CheckStr(Trim(Mid(strIPAddr, 1, 30)))End Function'显示部分IP地址function Ck(ip)Ck=mid(ip,1,instrRev(ip,"."))&"*"end function

8.格式化日期

Function FormatDate(DateAndTime, Format) On Error Resume Next Dim yy,y, m, d, h, mi, s, strDateTime FormatDate = DateAndTime If Not IsNumeric(Format) Then Exit Function If Not IsDate(DateAndTime) Then Exit Function yy = CStr(Year(DateAndTime)) y = Mid(CStr(Year(DateAndTime)),3) m = CStr(Month(DateAndTime)) If Len(m) = 1 Then m = "0" & m d = CStr(Day(DateAndTime)) If Len(d) = 1 Then d = "0" & d h = CStr(Hour(DateAndTime)) If Len(h) = 1 Then h = "0" & h mi = CStr(Minute(DateAndTime)) If Len(mi) = 1 Then mi = "0" & mi s = CStr(Second(DateAndTime)) If Len(s) = 1 Then s = "0" & s Select Case Format Case "1" strDateTime = y & "-" & m & "-" & d & " " & h & ":" & mi & ":" & s Case "2" strDateTime = yy & m & d & h & mi & s '返回12位 直到秒 的时间字符串 Case "3" strDateTime = yy & m & d & h & mi '返回12位 直到分 的时间字符串 Case "4" strDateTime = yy & "年" & m & "月" & d & "日" Case "5" strDateTime = m & "-" & d Case "6" strDateTime = m & "/" & d Case "7" strDateTime = m & "月" & d & "日" Case "8" strDateTime = y & "年" & m & "月" Case "9" strDateTime = y & "-" & m Case "10" strDateTime = y & "/" & m Case "11" strDateTime = y & "-" & m & "-" & d Case "12" strDateTime = y & "/" & m & "/" & d Case "13" strDateTime = yy & "." & m & "." & d Case "14" strDateTime = yy & "/" & m & "/" & d Case "15" strDateTime = yy & "-" & m & "-" & d Case Else strDateTime = DateAndTime End Select FormatDate = strDateTimeEnd Function

9.过滤sql函数

Function SqlIn(Str) If Isnull(Str) Then SqlIn = "" Exit Function End If Str=trim(Str) Str = Replace(Str,Chr(0),"", 1, -1, 1) Str = Replace(Str, """", """, 1, -1, 1) Str = Replace(Str,"<","<", 1, -1, 1) Str = Replace(Str,">",">", 1, -1, 1) Str = Replace(Str, "script", "script", 1, -1, 0) Str = Replace(Str, "SCRIPT", "SCRIPT", 1, -1, 0) Str = Replace(Str, "Script", "Script", 1, -1, 0) Str = Replace(Str, "script", "Script", 1, -1, 1) Str = Replace(Str, "object", "object", 1, -1, 0) Str = Replace(Str, "OBJECT", "OBJECT", 1, -1, 0) Str = Replace(Str, "Object", "Object", 1, -1, 0) Str = Replace(Str, "object", "Object", 1, -1, 1) Str = Replace(Str, "applet", "applet", 1, -1, 0) Str = Replace(Str, "APPLET", "APPLET", 1, -1, 0) Str = Replace(Str, "Applet", "Applet", 1, -1, 0) Str = Replace(Str, "applet", "Applet", 1, -1, 1) Str = Replace(Str, "[", "[") Str = Replace(Str, "]", "]") Str = Replace(Str, """", "", 1, -1, 1) Str = Replace(Str, "=", "=", 1, -1, 1) Str = Replace(Str, "'", "''", 1, -1, 1) Str = Replace(Str, "select", "select", 1, -1, 1) Str = Replace(Str, "execute", "execute", 1, -1, 1) Str = Replace(Str, "exec", "exec", 1, -1, 1) Str = Replace(Str, "join", "join", 1, -1, 1) Str = Replace(Str, "union", "union", 1, -1, 1) Str = Replace(Str, "where", "where", 1, -1, 1) Str = Replace(Str, "insert", "insert", 1, -1, 1) Str = Replace(Str, "delete", "delete", 1, -1, 1) Str = Replace(Str, "update", "update", 1, -1, 1) Str = Replace(Str, "like", "like", 1, -1, 1) Str = Replace(Str, "drop", "drop", 1, -1, 1) Str = Replace(Str, "create", "create", 1, -1, 1) Str = Replace(Str, "rename", "rename", 1, -1, 1) Str = Replace(Str, "count", "count", 1, -1, 1) Str = Replace(Str, "chr", "chr", 1, -1, 1) Str = Replace(Str, "mid", "mid", 1, -1, 1) Str = Replace(Str, "truncate", "truncate", 1, -1, 1) Str = Replace(Str, "nchar", "nchar", 1, -1, 1) Str = Replace(Str, "char", "char", 1, -1, 1) Str = Replace(Str, "alter", "alter", 1, -1, 1) Str = Replace(Str, "cast", "cast", 1, -1, 1) Str = Replace(Str, "exists", "exists", 1, -1, 1) Str = Replace(Str,Chr(13),"<br>", 1, -1, 1) SqlIn = Replace(Str,"'","''", 1, -1, 1)End Function