Ewebeditor and fckeditork editor filter single quotes

Ewebeditor and fckeditork editor filter single quotes

We used the writing method of SQL=insert into product(title,content) values(' &request(title)& ' ,' &request(content)& ' ), so we found the content that the customer COPYed into the editor at that time, and found that, Sure enough, this content contains single quotes. It turns out that it was precisely because the content submitted by the customer to the editor contained single quotes that our SQL statement changed, which is equivalent to SQL=insert into product(title,content) values. ('content' ,'content') becomes SQL=insert into product(title,content) values('content','content''). If we look closely, we will know that just because there is an extra single quotation mark in the content, the SQL statement occurs. There is a serious writing error. However, we are also surprised that since it is written incorrectly, why does the SQL statement not give an error message, but also prompts that the operation is successful? Thinking of this, we think of the common little hackers in the years of 2003. Like to use 'or' =' or' The background intrusion method seems to take advantage of the bug that single quotes are not filtered when SQL is executed. As a result, no matter how SQL is executed, the result returns true. Haha, I didn’t expect that. I thought that writing the program should be as simple and clear as possible, which is also a mistake. ah. Okay, the problem has been found. In the future, before all SQL is entered into the database, we will filter the fields before passing the value, so that this problem will no longer occur. Below is a very complete SQL security filtering function. You can just use it. It's ready to be called.

Function HTMLEncode(Str)

If Isnull(Str) Then

HTMLEncode =

Exit Function

End If

Str = Replace(Str,Chr(0),, 1, -1, 1)

Str = Replace(Str, , ", 1, -1, 1)

Str = Replace(Str,<,&lt;, 1, -1, 1)

Str = Replace(Str,>,&gt;, 1, -1, 1)

Str = Replace(Str, script, &#115;cript, 1, -1, 0)

Str = Replace(Str, SCRIPT, &#083;CRIPT, 1, -1, 0)

Str = Replace(Str, Script, &#083;cript, 1, -1, 0)

Str = Replace(Str, script, &#083;cript, 1, -1, 1)

Str = Replace(Str, object, object, 1, -1, 0)

Str = Replace(Str, OBJECT, &#079;BJECT, 1, -1, 0)

Str = Replace(Str, Object, &#079;object, 1, -1, 0)

Str = Replace(Str, object, object, 1, -1, 1)

Str = Replace(Str, applet, &#097;pplet, 1, -1, 0)

Str = Replace(Str, APPLET, &#065;PPLET, 1, -1, 0)

Str = Replace(Str, Applet, &#065;pplet, 1, -1, 0)

Str = Replace(Str, applet, &#065;pplet, 1, -1, 1)

Str = Replace(Str, [, &#091;)

Str = Replace(Str, ], &#093;)

Str = Replace(Str, , , 1, -1, 1)

Str = Replace(Str, =, &#061;, 1, -1, 1)

Str = Replace(Str, ', '', 1, -1, 1)

Str = Replace(Str, select, sel'ct, 1, -1, 1)

Str = Replace(Str, execute, &#101xecute, 1, -1, 1)

Str = Replace(Str, exec, &#101xec, 1, -1, 1)

Str = Replace(Str, join, jo&#105;n, 1, -1, 1)

Str = Replace(Str, union, un&#105;on, 1, -1, 1)

Str = Replace(Str, where, wh're, 1, -1, 1)

Str = Replace(Str, insert, ins&#101;rt, 1, -1, 1)

Str = Replace(Str, delete, del'te, 1, -1, 1)

Str = Replace(Str, update, up&#100;ate, 1, -1, 1)

Str = Replace(Str, like, lik&#101;, 1, -1, 1)

Str = Replace(Str, drop, dro&#112;, 1, -1, 1)

Str = Replace(Str, create, cr&#101;ate, 1, -1, 1)

Str = Replace(Str, rename, ren'me, 1, -1, 1)

Str = Replace(Str, count, co&#117;nt, 1, -1, 1)

Str = Replace(Str, chr, c&#104;r, 1, -1, 1)

Str = Replace(Str, mid, m&#105;d, 1, -1, 1)

Str = Replace(Str, truncate, trunc'te, 1, -1, 1)

Str = Replace(Str, nchar, nch'r, 1, -1, 1)

Str = Replace(Str, char, ch'r, 1, -1, 1)

Str = Replace(Str, alter, alt&#101;r, 1, -1, 1)

Str = Replace(Str, cast, ca't, 1, -1, 1)

Str = Replace(Str, exists, e&#120;ists, 1, -1, 1)

Str = Replace(Str,Chr(13), , 1, -1, 1)

HTMLEncode = Replace(Str,','', 1, -1, 1)

End Function