Ewebeditor和fckeditork編輯器過濾單引號

Ewebeditor和fckeditork編輯器過濾單引號

我們採用的是SQL=insert into product(title,content) values(' &request(title)& ' ,' &request(content)& ' )的寫法，於是我們找到客戶當時COPY進編輯器裡的內容，發現，果然這內容包含有單引號，原來，正是由於客戶提交到編輯器裡的內容中含有單引號，導致我們的SQL語句變化了，相當於原來是SQL=insert into product(title,content) values('內容' ,'內容' )變成了SQL=insert into product(title,content) values(' 內容' ,' 內容'' )，我們細看就知道，就因為這content裡多了個單引號，SQL語句發生的嚴重的寫法錯誤，但是，我們也奇怪，既然他寫法錯誤，為什麼SQL語句不給錯誤提示呢，竟然也會提示操作成功，想到這裡，我們想到了2003年那幾年，普遍的小黑客喜歡用的' 或' =' 或'的後台入侵法，是乎正是利用了SQL執行時，沒過濾單引號的BUG，導致SQL怎麼執行，結果都回真，呵呵，沒想到，原以為寫程式盡量圖了，也是個錯啊。好了，問題找到了，以後，凡是SQL入庫前，我們都把字段過濾後再傳值，就不會再出這樣的問題了，下面是一個非常完善的SQL安全過濾函數，大家直接拿去就可以調用了。

Function HTMLEncode(Str)

If Isnull(Str) Then

HTMLEncode =

Exit Function

End If

Str = Replace(Str,Chr(0),, 1, -1, 1)

Str = Replace(Str, , ", 1, -1, 1)

Str = Replace(Str,<,&lt;, 1, -1, 1)

Str = Replace(Str,>,&gt;, 1, -1, 1)

Str = Replace(Str, script, &#115;cript, 1, -1, 0)

Str = Replace(Str, SCRIPT, &#083;CRIPT, 1, -1, 0)

Str = Replace(Str, Script, &#083;cript, 1, -1, 0)

Str = Replace(Str, script, &#083;cript, 1, -1, 1)

Str = Replace(Str, object, &#111;bject, 1, -1, 0)

Str = Replace(Str, OBJECT, &#079;BJECT, 1, -1, 0)

Str = Replace(Str, Object, &#079;bject, 1, -1, 0)

Str = Replace(Str, object, &#079;bject, 1, -1, 1)

Str = Replace(Str, applet, &#097;pplet, 1, -1, 0)

Str = Replace(Str, APPLET, &#065;PPLET, 1, -1, 0)

Str = Replace(Str, Applet, &#065;pplet, 1, -1, 0)

Str = Replace(Str, applet, &#065;pplet, 1, -1, 1)

Str = Replace(Str, [, &#091;)

Str = Replace(Str, ], &#093;)

Str = Replace(Str, , , 1, -1, 1)

Str = Replace(Str, =, &#061;, 1, -1, 1)

Str = Replace(Str, ', '', 1, -1, 1)

Str = Replace(Str, select, sel&#101;ct, 1, -1, 1)

Str = Replace(Str, execute, &#101xecute, 1, -1, 1)

Str = Replace(Str, exec, &#101xec, 1, -1, 1)

Str = Replace(Str, join, jo&#105;n, 1, -1, 1)

Str = Replace(Str, union , un&#105;on, 1, -1, 1)

Str = Replace(Str, where, wh&#101;re, 1, -1, 1)

Str = Replace(Str, insert, ins&#101;rt, 1, -1, 1)

Str = Replace(Str, delete, del&#101;te, 1, -1, 1)

Str = Replace(Str, update, up&#100;ate, 1, -1, 1)

Str = Replace(Str, like, lik&#101;, 1, -1, 1)

Str = Replace(Str, drop, dro&#112;, 1, -1, 1)

Str = Replace(Str, create, cr&#101;ate, 1, -1, 1)

Str = Replace(Str, rename, ren&#097;me, 1, -1, 1)

Str = Replace(Str, count, co&#117;nt, 1, -1, 1)

Str = Replace(Str, chr, c&#104;r, 1, -1, 1)

Str = Replace(Str, mid, m&#105;d, 1, -1, 1)

Str = Replace(Str, truncate, trunc&#097;te, 1, -1, 1)

Str = Replace(Str, nchar, nch&#097;r, 1, -1, 1)

Str = Replace(Str, char, ch&#097;r, 1, -1, 1)

Str = Replace(Str, alter, alt&#101;r, 1, -1, 1)

Str = Replace(Str, cast, ca&#115;t, 1, -1, 1)

Str = Replace(Str, exists, e&#120;ists, 1, -1, 1)

Str = Replace(Str,Chr(13), , 1, -1, 1)

HTMLEncode = Replace(Str,','', 1, -1, 1)

End Function