|
马上注册,结交更多好友,享用更多功能,让你轻松玩转社区。
您需要 登录 才可以下载或查看,没有帐号?立即注册
x
ASP由于使用了COM组件所以它会变的十分强大,但是这样的强大由于WindowsNT系统最初的设计问题而会引发大量的安全问题。只要在这样的组件或是操作中一不注意,哪么外部攻击就可以取得相当高的权限而导致网站瘫痪或者数据丢失;<%
Defineyoursqlinfohere
strSQLDSN="xxxx"
strSQLUsername="sa"
strSQLPassword=""
Thisiswhereweconnecttooursqlserver
SetadoConn=Server.CreateObject("ADODB.Connection")
ConnectionString="dsn="&strSQLDSN&";uid="&strSQLUsername&";pwd="&strSQLPassword&""
adoConn.OpenConnectionString
SetadoRS=Server.CreateObject("ADODB.Recordset")
nowwewilljustdifineacouplethings
showblank=""
shownull="-null-"
IfRequest.QueryString("action")="del"Then
Delete_Data
Else
IfRequest.QueryString("table")""Then
Atablehasbeenselected
Page_Head
Display_Table_Names
IfRequest.QueryString("msg")="deleted"Then
Response.Write("<p><br></p>")
Response.Write("<fontcolor=""#FF0000""><b>乐成删除数据</b></font>")
Else
Response.Write("<p><br></p>")
EndIf
Display_Table_Info
Else
Notablehasbeenselected.
Page_Head
Display_Table_Names
EndIf
EndIf
SubPage_Head
%>
<HTML>
<HEAD>
<TITLE>SQLViewer</TITLE>
<BODYaLink=#0663bfleftMargin="0"link="#0663bf"topMargin="0"vLink="#0663bf"MARGINHEIGHT="0"
MARGINWIDTH="0">
</HEAD>
<p><br></p>
<%
EndSub
SubDelete_Data
strSQL="DeleteFrom"&Request.QueryString("table")&"WhereID="&
Request.QueryString("id")&""
SetadoRS=adoConn.Execute(strSQL)
strURL="index.asp?table="&Request.QueryString("table")&"&msg=deleted"
Response.Redirect(strURL)
EndSub
SubDisplay_Table_Names
Response.Write("<divalign=""center""><center>"&vbCrLf)
Response.Write(""&vbCrLf)
Response.Write("<tableborder=""1""cellpadding=""0""cellspacing=""0""width=""36%""
bordercolor=""#9b9180"">"&vbCrLf)
Response.Write("<trbgColor=""#9b9180"">"&vbCrLf)
Response.Write("<tdwidth=""100%""><palign=""center""><font
color=""#FFFFFF""><strong>SQLViewer</strong></font></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("<trbgColor=""#dcd8d1"">"&vbCrLf)
Response.Write("<tdwidth=""100%""><divalign=""center""><center><tableborder=""0""
cellpadding=""0"""&vbCrLf)
Response.Write("cellspacing=""0""width=""100%"">"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Response.Write("<tdwidth=""100%""></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Response.Write("<tdwidth=""100%""NOWRAP><center><selectsize=""1""
name=""Table""style=""font-family:Verdana;font-size:8pt""
onChange=""top.location.href=this.options[this.selectedIndex].value"">"&vbCrLf)
Response.Write("<optionselectedvalue>请选择表名举行检察.</option>"&vbCrLf)
strSQL="SELECTnameFROMsysobjectsWHERExtype=UAND(Not(id)=133575514)ORDER
BYname"
SetadoRS=adoConn.Execute(strSQL)
DoWhileNotadoRS.EOF
Response.Write"<optionvalue=""index.asp?table="&adoRS("name")&""">"&
adoRS("name")&"</option>"
adoRS.MoveNext
Loop
Response.Write("</select></center></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Response.Write("<tdwidth=""100%""></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("</table>"&vbCrLf)
Response.Write("</center></div></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("</table>"&vbCrLf)
Response.Write("</center></div>"&vbCrLf)
EndSub
SubDisplay_Table_Info
Response.Write("<divalign=""center""><center>"&vbCrLf)
Response.Write("<tableborder=""1""cellpadding=""0""cellspacing=""0""width=""36%""
bordercolor=""#9b9180"">"&vbCrLf)
Response.Write("<trbgColor=""#9b9180"">"&vbCrLf)
Response.Write("<tdwidth=""100%""><palign=""center""><font
color=""#FFFFFF""><strong>SQL破戒</strong></font></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("<trbgColor=""#dcd8d1"">"&vbCrLf)
Response.Write("<tdwidth=""100%""><divalign=""center""><center><tableborder=""0""
cellpadding=""0"""&vbCrLf)
Response.Write("cellspacing=""0""width=""100%"">"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Response.Write("<td></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Thisselectsthetablethatwewanttouse.
strSQL="select*from"&Request.QueryString("table")&""
setadoRS=adoConn.execute(strSQL)
Nowletsstartthetable
Response.Write("<tableborder=""1""><tr>"&vbCrLf)
thiswillfindallthefieldsinthattableandwritethemout
FOREACHfieldnameINadoRS.fields
Response.Write("<td><b><fontsize=""2"">"&fieldname.name&"</font></B></TD>")
NEXTfieldname
Response.Write("<td><b><fontsize=""2"">删除</font></B></TD>")
Response.Write("</tr>"&vbCrLf)
DOUNTILadoRS.eof
Response.Write("<tr>")
FOREACHfieldnameINadoRS.fields
strFieldValue=fieldname.value
strField=fieldname.name
IFisnull(strFieldValue)THEN
strFieldValue=shownull
ENDIF
IFtrim(strFieldValue)=""THEN
strFieldValue=showblank
ENDIF
IFstrField="ID"ORstrField="id"THEN
strRecordID=strFieldValue
ENDIF
Response.Write("<tdvalign=top><fontsize=""2"">"&strFieldValue&
"</font></td>"&vbCrLf)
NEXT
Response.Write("<tdvalign=top><fontsize=""2""><ahref=""index.asp?table="&
Request.QueryString("table")&"&id="&strRecordID&"&action=del"">删除</a></font></td>"&
vbCrLf)
adoRS.movenext
LOOP
Response.Write("</table>")
adoRS.close
Response.Write("</tr>"&vbCrLf)
Response.Write("<tr>"&vbCrLf)
Response.Write("<td></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("</table>"&vbCrLf)
Response.Write("</center></div></td>"&vbCrLf)
Response.Write("</tr>"&vbCrLf)
Response.Write("</table>"&vbCrLf)
Response.Write("</center></div>"&vbCrLf)
EndSub
%>
ASP一般认为只能运行在IIS上,正如前面所提到的,这并不是十分正确,事实上,ASP也能运行在Apache上。ApacheASP可在任意Apache服务器上运行有限的ASP功能,所需做的,只需打开mod_perl。 |
|