方法1: Replace过滤字符
解决方法:查找login.asp下的 pass=request.Form("pass") 修改为：username=Replace(request.Form("name"), "’", "’’") pass=Replace(request.Form("pass"), "’", "’’") 语法是屏蔽’和’’字符来达到效果. 方法2：在conn.asp 内加入 注前提 登陆页面有) 把以下代码保存为safe.asp 程序代码<% Dim Query_Badword,Form_Badword,i,Err_Message,Err_Web,name Err_Message = 3 Err_Web = "safe.htm" ’出错时转向的页面 Query_Badword="’|and|select|update|chr|delete|%20from|;|insert|mid|master.|set|chr(37)|=" ’在这部份定义get非法参数,使用"|"号间隔 Form_Badword="’|(|)|;|=" ’在这部份定义post非法参数,使用"|"号间隔 On Error Resume Next if request.QueryString<>"" then Chk_badword=split(Query_Badword,"|") FOR EACH Query_Name IN Request.QueryString for i=0 to ubound(Chk_badword) If Instr(LCase(request.QueryString(Query_Name)),Chk_badword(i))<>0 Then Select Case Err_Message Case "1" Response.Write "" Case "2" Response.Write "" Case "3" Response.Write "" End Select Response.End End If NEXT NEXT End if if request.form<>"" then Chk_badword=split(Form_Badword,"|") FOR EACH name IN Request.Form for i=0 to ubound(Chk_badword) If Instr(LCase(request.form(name)),Chk_badword(i))<>0 Then Select Case Err_Message Case "1" Response.Write "" Case "2" Response.Write "" Case "3" Response.Write "" End Select Response.End End If NEXT NEXT end if %>