asp教程中g(shù)et post提交表單有5點(diǎn)區(qū)別

!--兩個(gè)Form只有Method屬性不同--> 
FORM ACTION=“getpost.php教程” METHOD=“get”> 
INPUT TYPE=“text” NAME=“Text” VALUE=“Hello World”>/INPUT> 
INPUT TYPE=“submit” VALUE=“Method=Get”>/INPUT> 
/FORM> 
BR> 
FORM ACTION=“getpost.php” METHOD=“post”> 
INPUT TYPE=“text” NAME=“Text” VALUE=“Hello World”>/INPUT> 
INPUT TYPE=“submit” VALUE=“Method=Post”>/INPUT> 
/FORM> 
? If Request.QueryString(“Text”) > ““ Then ?> 
通過get方法傳遞來的字符串是： “B>?= Request.QueryString(“Text”) ?>/B>“BR> 
? End If ?> 
? If Request.Form(“Text”) > ““ Then ?> 
通過Post方法傳遞來的字符串是： “B>?= Request.Form(“Text”) ?>/B>“BR> 
? End If ?> 

'獲取參數(shù)值
Function getForm(element,ftype)
	Select case ftype
		case "get"
			getForm=trim(request.QueryString(element))
		case "post"
			getForm=trim(request.Form(element))
		case "both"
			if isNul(request.QueryString(element)) then getForm=trim(request.Form(element)) else getForm=trim(request.QueryString(element))
	End Select	
	getForm=replace(getForm,CHR(34),"quot;")
	getForm=replace(getForm,CHR(39),"apos;")
End Function

Title=getForm("Title", "post")
Title2=getForm("Title2", "post")
Author=getForm("Author", "post")
ContentSource=getForm("ContentSource", "post")
Content=getForm("Content", "post")

'過濾參數(shù)
Function filterPara(byVal Para)
    filterPara=preventSqlin(Checkxss(Para))
End Function

Function preventSqlin(content)

	dim sqlStr,sqlArray,i,speStr
	sqlStr="|>|%|%27|%16|'|''|;|*|and|exec|dbcc|alter|drop|insert|select|update|delete|count|master|truncate|char|declare|where|set|declare|mid|chr|union|from|{prefix}|top|user|/|\"

	if isNul(content) then Exit Function
	sqlArray=split(sqlStr,"|")
	for i=lbound(sqlArray) to ubound(sqlArray)
		if instr(lcase(content),sqlArray(i))>0 then
				select case sqlArray(i)
					case "":speStr="lt;"
					case ">":speStr="gt;"
					case "'","""":speStr="quot;"
					'case ";":speStr="；"
					case else:speStr=""
				end select
				content=replace(content,sqlArray(i),speStr)		
		end if
	next
	dim num
	num=0
	for i=lbound(sqlArray) to ubound(sqlArray)
		if instr(lcase(content),sqlArray(i))>0 then
			num=1
		end if
	next
	if num=1 then 
	
		content=preventSqlin(content)
	end if
	preventSqlin=content
End Function

'過濾xss注入
Function checkxss(byVal ChkStr)
    dim Str,re
    Str = ChkStr
    if IsNull(Str) then  Checkxss = "" : Exit Function
    Str = Replace(Str, "", "") : Str = Replace(Str, "'", "acute;") : Str = Replace(Str, """", "quot;") : Str = Replace(Str, "", "lt;") : Str = Replace(Str, ">", "gt;") : Str = Replace(Str, "/", "#47;") : Str = Replace(Str, "*", "#42;")
    Set re = New RegExp
    re.IgnoreCase = True : re.Global = True
    re.Pattern = "(w)(here)" : Str = re.Replace(Str, "$1h#101;re")
	re.Pattern = "(s)(elect)" : Str = re.Replace(Str, "$1el#101;ct")
	re.Pattern = "(i)(nsert)" : Str = re.Replace(Str, "$1ns#101;rt")
	re.Pattern = "(c)(reate)" : Str = re.Replace(Str, "$1r#101;ate")
	re.Pattern = "(d)(rop)" : Str = re.Replace(Str, "$1ro#112;")
	re.Pattern = "(a)(lter)" : Str = re.Replace(Str, "$1lt#101;r")
	re.Pattern = "(d)(elete)" : Str = re.Replace(Str, "$1el#101;te")
	re.Pattern = "(u)(pdate)" : Str = re.Replace(Str, "$1p#100;ate")
	re.Pattern = "(\s)(or)" : Str = re.Replace(Str, "$1o#114;")
	re.Pattern = "(java)(script)" : Str = re.Replace(Str, "$1scri#112;t")
	re.Pattern = "(j)(script)" : Str = re.Replace(Str, "$1scri#112;t")
	re.Pattern = "(vb)(script)" : Str = re.Replace(Str, "$1scri#112;t")
	If Instr(Str, "expression") > 0 Then Str = Replace(Str, "expression", "e#173;xpression", 1, -1, 0)
    Set re = Nothing
    Checkxss = Str
End Function