ASP,安全写入数据库操作,正常读出并显示在不同的场合

最新推荐文章于 2025-09-11 20:53:34 发布

原创最新推荐文章于 2025-09-11 20:53:34 发布 · 752 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#数据库 #asp #function #sql #html #url

博客探讨数据库中styledesc字段输入限制及安全操作问题。在输入尽可能不作限制的情况下，给出字符串输出到HTML、Script、SQL语句、URL的处理函数，如对特殊字符进行替换等操作，以实现安全写入数据库并正常读出显示。

比如说有styledesc这个字段,数据要求的是50位,char形,可不可以只限制他50位,其它的不限制,
输入什么字符都可以的.只要是char形,只要数据库允许就行

这样,安全写入数据库操作,正常读出并显示在不同的场合,应用.

应该是怎样做呢?

下面是我总结的几点.非常有可能不对,请指正.
如果对用户的输入是可以任意字符,(除了某字段特定的输入限制条件,如输入长度,输入类型==).
就是输入尽可能不作限制.

对一字符串str,他输出的方向有以下几种:
1.输出至HTML中,Function fn_chk_to_html(Str)
2.输出至Script中(如javascript),Function fn_chk_to_script(Str)
3.输出至sql语句中,而且这条SQL语句是用''两个单引括起字符串Str的.
Function fn_chk_to_sql_mark(Str)
4.输出至sql语句中,而且这条SQL语句是没有用单引括起Str的.Function fn_chk_to_sql_go(Str)
5.输出至URL .Function fn_chk_to_url(Str)

<%Function fn_chk_to_html(Str)
'如<input text="<%=request("styledesc")%>">的情况下
If Isnull(Str) Then
fn_chk_to_html = ""
Exit Function
End If
Str = trim(Str)
Str = Replace(Str, Chr(0), "",1,-1,1)
Str = Replace(Str, """", """,1,-1,1)
Str = Replace(Str, "'", "'",1,-1,1)
Str = Replace(Str, "<","<",1,-1,1)
Str = Replace(Str, ">",">",1,-1,1)
Str = Replace(Str, vbCrlf, "<br>",1,-1,1)
fn_chk_to_html = Str
End Function
%>

<%Function fn_chk_to_script(Str)
'如 response.write "<script>alert('"&request("styledesc")&"');</script>"的情况下
If Isnull(Str) Then
fn_chk_to_script = ""
Exit Function
End If
Str = trim(Str)
Str = Replace(Str, "/", "//",1,-1,1)
Str = Replace(Str, """", "/""",1,-1,1)
Str = Replace(Str, "'", "/'",1,-1,1)
Str = Replace(Str,Chr(13),"/n",1,-1,1)
fn_chk_to_script = Str
End Function
%>
<%
Function fn_chk_to_sql_mark(Str)
'如 sql="select * from style where styledesc like '"&request("styledesc")&"'"的情况下
If Isnull(Str) Then
fn_chk_to_sql_mark= ""
Exit Function
End If
Str = trim(Str)
Str = Replace(Str, "'", "''",1,-1,1)
fn_chk_to_sql_mark = Str
End Function
%>

<%Function fn_chk_to_sql_go(Str)
'如sql = "select * from "&request("table")的情况下.??
If Isnull(Str) Then
fn_chk_to_sql_go = ""
Exit Function
End If
Str = trim(Str)
Str = Replace(Str, Chr(0), "",1,-1,1)
Str = Replace(Str, """", """,1,-1,1)
Str = Replace(Str, "'", "'",1,-1,1)
Str = Replace(Str, "<","<",1,-1,1)
Str = Replace(Str, ">",">",1,-1,1)
Str = Replace(Str, "[", "[",1,-1,1)
Str = Replace(Str, "]", "]",1,-1,1)
Str = Replace(Str, "/", "\",1,-1,1)
Str = Replace(Str, "*", "*",1,-1,1)
Str = Replace(Str, "%", "%",1,-1,1)
Str = Replace(Str, ";", ";",1,-1,1)
Str = Replace(Str, vbCrlf, "<br>",1,-1,1)
Str = Replace(Str, "--", "--")
fn_chk_to_sql_go = Str
End Function
%>

<%Function fn_chk_to_url(Str)

'如 str="<img src='showimg.asp?id="&request("id")&"'>"的情况下
If Isnull(Str) Then
fn_chk_to_url = ""
Exit Function
End If
Str = trim(Str)
Str = server.URLEncode(Str)
fn_chk_to_url= Str
End Function
%>