Question

ASP高手请帮忙分析一下!!!急!!!!

ASP高手请帮忙分析一下!!!急!!!!

我的音乐网在添加日文歌曲后,进行模糊搜索歌曲搜索不到,只能用准确搜索,去掉日文歌曲后才能恢复模糊搜索,请问是不是数据库哪里有问题?
是不是字段的属性没选择对?请给我分析一下吧,先谢了!!
www.21kudy.com

Answer 1

Function ReplaceBadChar(strChar)
If strChar = "" Or IsNull(strChar) Then
ReplaceBadChar = ""
Exit Function
End If
Dim strBadChar, arrBadChar, tempChar, i
strBadChar = "过滤字符1,过滤字符2,....,过滤字符n"
arrBadChar = Split(strBadChar, ",")
tempChar = strChar
For i = 0 To UBound(arrBadChar)
tempChar = Replace(tempChar, arrBadChar(i), "")
Next
tempChar = Replace(tempChar, "@@", "@")
ReplaceBadChar = tempChar
End Function

之后调用ReplaceBadChar()来过滤非法字符

或用这个通用的防止注入
<%
'SQL通用防注入程序
'--------定义部份------------------
Dim Fy_Post,Fy_Get,Fy_In,Fy_Inf,Fy_Xh,Fy_db,Fy_dbstr
'自定义需要过滤的字串,用 "岛" 分隔
'Fy_In = "'枫;枫and枫exec枫insert枫select枫delete枫update枫count枫*枫%枫chr枫mid枫master枫truncate枫char枫declare"
Fy_In = "exec岛insert岛select岛delete岛update岛count岛master岛truncate岛declare"
'----------------------------------
%>

<%
Fy_Inf = split(Fy_In,"岛")
'--------POST部份------------------
If Request.Form<>"" Then
For Each Fy_Post In Request.Form

For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.Form(Fy_Post)),Fy_Inf(Fy_Xh))<>0 Then

Response.Write "<Script Language=JavaScript>alert('SQL防注入系统提示↓\n\n请不要在参数中包含非法字符尝试注入！\n\n 操作将全部被记录到数据库！');</Script>"
Response.Write "非法操作！系统做了如下记录↓<br>"
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：POST<br>"
Response.Write "提交参数："&Fy_Post&"<br>"
Response.Write "提交数据："&Request.Form(Fy_Post)
Response.End
End If
Next

Next
End If
'----------------------------------

'--------GET部份-------------------
If Request.QueryString<>"" Then
For Each Fy_Get In Request.QueryString

For Fy_Xh=0 To Ubound(Fy_Inf)
If Instr(LCase(Request.QueryString(Fy_Get)),Fy_Inf(Fy_Xh))<>0 Then
Response.Write "<Script Language=JavaScript>alert('SQL防注入系统提示↓\n\n请不要在参数中包含非法字符尝试注入！\n\n 操作将全部被记录到数据库！');</Script>"
Response.Write "非法操作！系统做了如下记录↓<br>"
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>"
Response.Write "操作时间："&Now&"<br>"
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"
Response.Write "提交方式：GET<br>"
Response.Write "提交参数："&Fy_Get&"<br>"
Response.Write "提交数据："&Request.QueryString(Fy_Get)
Response.End
End If
Next
Next
End If
'----------------------------------
%>

Answer 2

看来是日文歌曲信息的字符造成的，做个针对的过滤函数罗。

Answer 3

系统不支持阿！