您所在的位置:小祥子 » 编程 » ASP » 正文

ASP过滤xss注入代码

时间:2015-02-16 编辑:本站 来源:本站原创

网站安全很重要,过滤不严一不小心就被利用了。过滤XSS代码如下,无非是替换一些关键词

Function Checkxss(byVal ChkStr)
    Dim Str
    Str = ChkStr
    If IsNull(Str) Then
        CheckStr = ""
        Exit Function
    End If
    Str = Replace(Str, "&", "&")
    Str = Replace(Str, "'", "´")
    Str = Replace(Str, """", """)
        Str = Replace(Str, "<", "<")
        Str = Replace(Str, ">", ">")
        Str = Replace(Str, "/", "/")
        Str = Replace(Str, "*", "*")
    Dim re
    Set re = New RegExp
    re.IgnoreCase = True
    re.Global = True
    re.Pattern = "(w)(here)"
    Str = re.Replace(Str, "$1here")
    re.Pattern = "(s)(elect)"
    Str = re.Replace(Str, "$1elect")
    re.Pattern = "(i)(nsert)"
    Str = re.Replace(Str, "$1nsert")
    re.Pattern = "(c)(reate)"
    Str = re.Replace(Str, "$1reate")
    re.Pattern = "(d)(rop)"
    Str = re.Replace(Str, "$1rop")
    re.Pattern = "(a)(lter)"
    Str = re.Replace(Str, "$1lter")
    re.Pattern = "(d)(elete)"
    Str = re.Replace(Str, "$1elete")
    re.Pattern = "(u)(pdate)"
    Str = re.Replace(Str, "$1pdate")
    re.Pattern = "(\s)(or)"
    Str = re.Replace(Str, "$1or")
        re.Pattern = "(\n)"
    Str = re.Replace(Str, "$1or")
        '----------------------------------
        re.Pattern = "(java)(script)"
    Str = re.Replace(Str, "$1script")
        re.Pattern = "(j)(script)"
    Str = re.Replace(Str, "$1script")
        re.Pattern = "(vb)(script)"
    Str = re.Replace(Str, "$1script")
        '----------------------------------
        If Instr(Str, "expression") > 0 Then
                Str = Replace(Str, "expression", "e­xpression", 1, -1, 0)
        End If
    Set re = Nothing
    Checkxss = Str
End Function

关键词:XSS 过滤