Good way to sanitize input in classic asp

问题

I have to update old projects at work. I do not have any experience with classic asp, although i'm familiar with php scripting.

Are there any functions I should use?
Can you provide me with a good function for some basic protection?
Is there something like a parameterized query in asp?

Thanks!

回答1:

Yes you can use parametrized queries in classic ASP (more accurately, classic ADO).

Here is a link.

As for encoding output, I might be tempted to create a wrapper for the latest Microsoft Anti-XSS library and call it with Server.CreateObject. I am far from an expert on this kind of thing as I spend much more time in .Net, so I only think this would work.

Server.HTMLEncode is really not good enough, as it only blacklists a few encoding characters. The Anti-XSS library is much better as it whitelists what is acceptable.

回答2:

Always use Server.HTMLEncode to sanitize user input.

For example, if you're setting a variable from a form text box:

firstName = Server.HTMLEncode(trim(request.form("firstname")))

回答3:

Watch out for SQL injection. Do not concatenate user input to a SQL string and then execute it. Instead, always used parameterized queries.

回答4:

There is a bunch of functions starting with Is, such as IsNumber, IsArray etcetera, that might be of interest. Also if you're expecting a integer, you could use CLng(Request("blabla")) to get it, thus if it's not a integer the CLng function will raise an error.

回答5:

One way to do it might be to add a check in a header.asp file that iterates through the Request object looking for inappropriate characters. For example:

<%
    for each x in Request.Form ' Do this for Request.Querystring also
        If InStr(x,"<") <> 0 Then
            ' encode the value or redirect to error page?
        End If
    next
%>

回答6:

Just make a function which will be called every time you want to output a string. It will encode html and output it as a text. E.g. escape html.

FUNCTION esc(a)
esc= Server.HTMLEncode(a)
END FUNCTION

Response.Write  esc("&*)!(@)#(!@)#SSDx><''")

output: &*)!(@)#(!@)#SSDx><''

来源：https://stackoverflow.com/questions/444181/good-way-to-sanitize-input-in-classic-asp

标签

security

asp-classic

sanitization