程序代码

Sub showimg(FileName)
    Response.Clear
    Dim Jpeg,temp_pic
    On Error Resume Next
    Set Jpeg = Server.CreateObject("Persits.Jpeg") 
    If -2147221005=Err then 
        'Response.write "没有这个组件，请安装!" '检查是否安装AspJpeg组件
        downloadFile FileName
        Exit Sub
    End If 
    Jpeg.Open (Server.MapPath(FileName)) '打开图片 
    If err.number then 
        'Response.write "打开图片失败,请检查路径！" 
        Jpeg.Open (Server.MapPath("images/logos.gif"))
        response.end
    End if 
    temp_pic=Jpeg.Binary
    Response.ContentType = "image/*"
    Response.AddHeader "Content-Disposition","filename=" & arr_FileName(FileName)
    Response.BinaryWrite temp_pic
    Response.End
End Sub 

网站建设的防盗链正是用以下两函数的配合处理。

防盗链下载函数 downloadFile 需要　服务器支持ADODB.Stream

程序代码

Sub downloadFile(strFile)
        On error resume next
        Server.ScriptTimeOut=999999
        Dim S,fso,f,intFilelength,strFilename,DownFileName

        strFilename = Server.MapPath(strFile)
        Response.Clear
        Set s = Server.CreateObject("ADODB.Stream") 
        s.Open
        s.Type = 1 
        Set fso = Server.CreateObject("Scripting.FileSystemObject") 
        If Not fso.FileExists(strFilename) Then
            'Response.Write("<h1>错误: </h1><br>系统找不到指定文件")
            showimg "images/logos.gif"
            Exit Sub        
        End If
        Set f = fso.GetFile(strFilename)
            intFilelength = f.size
            s.LoadFromFile(strFilename)
            If err Then
                'Response.Write("<h1>错误: </h1>" & err.Description & "<p>")
                showimg "images/logos.gif"
                Response.End 
            End If
            Set fso=Nothing
            Dim Data
            Data=s.Read
            s.Close
            Set s=Nothing
            If Response.IsClientConnected Then 
                Response.AddHeader "Content-Disposition", "attachment; filename=" & strFile
                Response.AddHeader "Content-Length", intFilelength 
                Response.CharSet = "UTF-8" 
                Response.ContentType = "application/octet-stream"
                Response.BinaryWrite Data
                Response.Flush
            End If
    End Sub

一、地址栏参数注入，就是用request.querystring取得值的这个

二、表单参数注入，就是用request.form取得值的这个

三、cookies 

其实可以看成一个理儿，就是能输入值，能交互的让用户输入的地方都得做一下防。

做一个函数，截取这些地方提交的值，与一个数组（里面放着要过滤或检查的敏感字符）做一下对比

再献上我的一个过滤函数

Function ChkStr(Str) 
    if Isnull(Str) then 
        ChkStr = "" 
        exit Function  
    End if 
    Str = Replace(Str,Chr(0),"", 1, -1, 1) 
    Str = Replace(Str, """", """, 1, -1, 1) 
    Str = Replace(Str,"<","&lt;", 1, -1, 1) 
    Str = Replace(Str,">","&gt;", 1, -1, 1)  
    Str = Replace(Str, "script", "&#115;cript", 1, -1, 0) 
    Str = Replace(Str, "SCRIPT", "&#083;CRIPT", 1, -1, 0) 
    Str = Replace(Str, "Script", "&#083;cript", 1, -1, 0) 
    Str = Replace(Str, "script", "&#083;cript", 1, -1, 1) 
    Str = Replace(Str, "object", "&#111;bject", 1, -1, 0) 
    Str = Replace(Str, "OBJECT", "&#079;BJECT", 1, -1, 0) 
    Str = Replace(Str, "Object", "&#079;bject", 1, -1, 0) 
    Str = Replace(Str, "object", "&#079;bject", 1, -1, 1) 
    Str = Replace(Str, "applet", "&#097;pplet", 1, -1, 0) 
    Str = Replace(Str, "APPLET", "&#065;PPLET", 1, -1, 0) 
    Str = Replace(Str, "Applet", "&#065;pplet", 1, -1, 0) 
    Str = Replace(Str, "applet", "&#065;pplet", 1, -1, 1) 
    Str = Replace(Str, "[", "&#091;") 
    Str = Replace(Str, "]", "&#093;") 
    Str = Replace(Str, "=", "&#061;", 1, -1, 1) 
    Str = Replace(Str, "’", "&#039;", 1, -1, 1) 
    Str = Replace(Str, "select", "&#115;elect", 1, -1, 1) 
    Str = Replace(Str, "execute", "&#101;xecute", 1, -1, 1) 
    Str = Replace(Str, "exec", "&#101;xec", 1, -1, 1) 
    Str = Replace(Str, "join", "&#106;oin", 1, -1, 1) 
    Str = Replace(Str, "union", "&#117;nion", 1, -1, 1) 
    Str = Replace(Str, "where", "&#119;here", 1, -1, 1) 
    Str = Replace(Str, "insert", "&#105;nsert", 1, -1, 1) 
    Str = Replace(Str, "delete", "&#100;elete", 1, -1, 1) 
    Str = Replace(Str, "update", "&#117;pdate", 1, -1, 1) 
    Str = Replace(Str, "like", "&#108;ike", 1, -1, 1) 
    Str = Replace(Str, "drop", "&#100;rop", 1, -1, 1) 
    Str = Replace(Str, "create", "&#099;reate", 1, -1, 1) 
    Str = Replace(Str, "rename", "&#114;ename", 1, -1, 1) 
    Str = Replace(Str, "count", "&#099;ount", 1, -1, 1) 
    Str = Replace(Str, "chr", "&#099;hr", 1, -1, 1) 
    Str = Replace(Str, "mid", "&#109;id", 1, -1, 1) 
    Str = Replace(Str, "truncate", "&#116;runcate", 1, -1, 1) 
    Str = Replace(Str, "nchar", "&#110;char", 1, -1, 1) 
    Str = Replace(Str, "char", "&#099;har", 1, -1, 1) 
    Str = Replace(Str, "alter", "&#097;lter", 1, -1, 1) 
    Str = Replace(Str, "cast", "&#099;ast", 1, -1, 1) 
    Str = Replace(Str, "exists", "&#101;xists", 1, -1, 1) 
    Str = Replace(Str,VbCrlf, " ", 1, -1, 1) 
    Str = Replace(Str, "  ", "", 1, -1, 1) 
    ChkStr = Str 
End Function

更新数据时，rs(“字段”) = ChkStr(trim(Request.Form("表单参数")))

今天用dedecms上传图片，提示Upload filetype not allow，网上搜了有很多方法，

找到这个测试可用：

    修改 /include/uploadsafe.inc.php 第45行

   $imtypes = array 改成 $imgtypes = array 

   再更新缓存就ok了！

首先得知道对方机器的IP。如果不知道就用软件扫了。像p2p终结者之类的。如果知道就最好。这儿介绍的就是知道IP但不知道MAC的

ping   ip
然后arp   -a

进入路由。这个以D-Link为例：

进阶设定——过滤器——MAC地址过滤——只拒绝下述 MAC 地址之使用者存取网络

执行。OK。。上网速度快多了。。