网站安全建设知识 ASP网站黑客防范编程技巧

DBPath = Server.MapPath（“cmddb.mdb”） 
conn.Open “driver={Microsoft Access Driver （*.mdb）}；dbq=” & DBPath 

conn.open“shujiyuan” 

If trim(Request. cookies ("uname"))="fqy" and Request.cookies("upwd") =”fqy#e3i5.com” then 
……..more……… 
End if 

if not (rs.BOF or rs.eof) then 
login="true" 
Session("username"&sessionID) = Username 
Session("password"& sessionID) = Password 
‘Response.cookies(“username”)= Username 
‘Response.cookies(“Password”)= Password 

＜% 
server_v1=Cstr(Request.ServerVariables("HTTP_REFERER")) 
server_v2=Cstr(Request.ServerVariables("SERVER_NAME")) 
if mid(server_v1,8,len(server_v2))＜＞server_v2 then 
response.write "＜br＞＜br＞＜center>" 
response.write " " 
response.write "你提交的路径有误，禁止从站点外部提交数据请不要乱改参数！" 
response.write " 
" 
response.end 
end if 
%> 
‘个人感觉上面的代码过滤不是很好，有一些外部提交竟然还能堂堂正正的进来,于是再写一个. 
‘这个是过滤效果很好,建议使用. 
if instr(request.servervariables("http_referer"),"http://"&request.servervariables("host") )
<1 then response.write "处理 URL 时服务器上出错。 
如果您是在用任何手段攻击服务器，那你应该庆幸，你的所有操作已经被服务器记录，
我们会第一时间通知公安局与国家安全部门来调查你的IP. " 
response.end 
end if 

------------len.reg----------------- 
Windows Registry Editor Version 5.00 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\扩展(&E)] 
@="C:\Documents and Settings\Administrator\桌面\len.htm" 
"contexts"=dword:00000004 
-----------end---------------------- 
-----------len.htm------------------ 
 
----------end----------------------- 

'判断文件类型是否合格 
Private Function CheckFileExt (fileEXT) 
dim Forumupload 
Forumupload="gif,jpg,bmp,jpeg" 
Forumupload=split(Forumupload,",") 
for i=0 to ubound(Forumupload) 
if lcase(fileEXT)=lcase(trim(Forumupload(i))) then 
CheckFileExt=true 
exit Function 
else 
CheckFileExt=false 
end if 
next 
End Function 
‘验证文件内容的合法性 
set MyFile = server.CreateObject ("Scripting.FileSystemObject") 
set MyText = MyFile.OpenTextFile (sFile, 1) ' 读取文本文件 
sTextAll = lcase(MyText.ReadAll): MyText.close 
'判断用户文件中的危险操作 
sStr ="8.getfolder.createfolder.deletefolder.createdirectory 
.deletedirectory" 
sStr = sStr & ".saveaswscript.shellscript.encode" 
sNoString = split(sStr,"") 
for i = 1 to sNoString(0) 
if instr(sTextAll, sNoString(i)) ＜＞ 0 then 
sFile = Upl.Path & sFileSave: fs.DeleteFile sFile 
Response.write "＜center＞＜br＞＜big＞"& sFileSave &"文件中含有与操作目录等有关的命令"&_ 
"＜br＞＜font color=red＞"& mid(sNoString(i),2) &"＜/font＞，
为了安全原因，＜b＞不能上传。＜b＞"&_"＜/big＞＜/center＞＜/html＞" 
Response.end 
end if 
next