注册
登录
| 关键词： file 文件 write thenresponse response 图片 upload filename filesize instr |
攻击exp: 开始来搭建所需要的环境和数据结构！先新建一个名字叫photo的文件夹。(我在这里就是把图片上传到这个文件夹里的。)建立一个名字叫database的数据库。再接着建立一个名字叫sFile的表。表里设计四个字段分别是id(int),image(varchar),image1(varchar),image2(varchar)。我这里用的数据库是SQL。相关的文件register.asp<html><head><title>文件</title><meta http-equiv="Content-Type" content="text/html; charset=gb2312"></head><body><form name="form1" method="post" action="save.asp"><table width="50%" border="1" cellspacing="0" cellpadding="0" align="center"><tr> <td width="20%"><a href="#" OnClick="javascript:window.open(''/reg_upload.asp'',null,'' left=40%,top=40%,height=250,width=470,status=yes,toolbar=no,menubar=no,resizable=yes,copyhistory=yes,scrollbars=yes,location=no,status=no,titlebar=no'')">图片上传</a></td><td width="80%"> <input type="text" name="myface"> <input type="text" name="myface1"> <input type="text" name="myface2">(此处用户不必填图片上传后自动生成) </td></tr><tr> <td colspan="2" align="center"> <input type="submit" name="Submit" value="提交"><input type="reset" name="Submit2" value="重设"></td></tr></table></form></body></html>reg_upload.asp<html><head><title></title><meta http-equiv="Content-Type" content="text/html; charset=gb2312"><link rel="stylesheet" href="http://www.7747.net/Article/200410/css/style.css" type="text/css"></head><body leftmargin="0" topmargin="0" > <br><br><br><table width="90%" border="0" align="center" bgcolor="#000000" height="152" cellspacing="1"><tr> <td height="34" align="center" bgcolor="#FFFFFF"><font color="#FFFF33"><b><font size="4" color="#000000">选择图片</font></b></font></td></tr><tr> <td bgcolor="#FFFFFF"> <form name="form" method="post" action="upfile.asp" enctype="multipart/form-data" ><input type="hidden" name="filepath" value="photo"><input type="hidden" name="act" value="upload"><input type="file" name="file1" size="30"><br><input type="file" name="file2" size="30"><br><input type="file" name="file3" size="30"> <input type="submit" name="Submit" value="粘 贴" class="tl"></form></td></tr></table></body></html> upfile.asp<!--#include FILE="upload.inc"--><html><head><title>文件上传</title></head><body><%dim arr(3)dim upload,file,formName,formPath,iCount,filename,fileExt,iset upload=new upload_5xSoft ''''建立上传对象 formPath=upload.form("filepath")''''在目录后加(/)if right(formPath,1)<>"/" then formPath=formPath&"/" iCount=0i=0for each formName in upload.file ''''列出所有上传了的文件set file=upload.file(formName) ''''生成一个文件对象 if file.filesize<0 thenresponse.write "<font size=2>请先选择你要上传的图片 [ <a href=# onclick=history.go(-1)>重新上传</a> ]</font>"response.endend if if file.filesize>100000 thenresponse.write "<font size=2>图片大小超过了限制 [ <a href=# onclick=history.go(-1)>重新上传</a> ]</font>"response.endend ifif fileEXT<>".gif" and fileEXT<>".jpg" thenresponse.write "<font size=2>文件格式不对 [ <a href=# onclick=history.go(-1)>重新上传</a> ]</font>"response.endend if fileExt=lcase(right(file.filename,4))filename=formPath&year(now)&month(now)&day(now)&hour(now)&minute(now)&second(now)&file.FileNamearr(i)=filenamei=i+1 if file.FileSize>0 then ''''如果 FileSize > 0 说明有文件数据file.SaveAs Server.mappath(filename) ''''保存文件'' response.write file.FilePath&file.FileName&" ("&file.FileSize&") => "&formPath&File.FileName&" 成功!<br>" iCount=iCount+1end ifset file=nothingnextif instr(arr(0),".")=0 and instr(arr(1),".")=0 and instr(arr(2),".")=0 thenresponse.write "<font size=2>请先选择你要上传的图片 [ <a href=# onclick=history.go(-1)>重新上传</a> ]</font>"response.endend ifif instr(arr(0),".")<>0 thenresponse.write "<script>opener.document.forms[0].myface.value=''" & arr(0) & "''</script>"elseresponse.write "<script>opener.document.forms[0].myface.value=''''</script>"end ifif instr(arr(1),".")<>0 thenresponse.write "<script>opener.document.forms[0].myface1.value=''" & arr(1) & "''</script>"elseresponse.write "<script>opener.document.forms[0].myface1.value=''''</script>"end ifif instr(arr(2),".")<>0 thenresponse.write "<script>opener.document.forms[0].myface2.value=''" & arr(2) & "''</script>"elseresponse.write "<script>opener.document.forms[0].myface2.value='''' </script>"end ifset upload=nothing ''''删除此对象 session("upface")="done" Htmend iCount&" 个文件上传结束!" sub HtmEnd(Msg)set upload=nothingresponse.write "<html><head><meta http-equiv=''Refresh'' content=''3 url=""javascript:window.close();""''></head><body><center><br><br>文件上传成功<br>谢谢你的支持！<br>本窗口三秒后自动关闭</center></body></html>"response.endend sub%></body></html>upload.inc<SCRIPT RUNAT=SERVER LANGUAGE=VBSCRIPT> dim upfile_5xSoft_Stream Class upload_5xSoft dim Form,File,Version Private Sub Class_Initialize dim iStart,iFileNameStart,iFileNameEnd,iEnd,vbEnter,iFormStart,iFormEnd,theFiledim strDiv,mFormName,mFormValue,mFileName,mFileSize,mFilePath,iDivLen,mStrVersion=""if Request.TotalBytes<1 then Exit Subset Form=CreateObject("Scripting.Dictionary")set File=CreateObject("Scripting.Dictionary")set upfile_5xSoft_Stream=CreateObject("Adodb.Stream")upfile_5xSoft_Stream.mode=3upfile_5xSoft_Stream.type=1upfile_5xSoft_Stream.openupfile_5xSoft_Stream.write Request.BinaryRead(Request.TotalBytes) vbEnter=Chr(13)&Chr(10)iDivLen=inString(1,vbEnter)+1strDiv=subString(1,iDivLen)iFormStart=iDivLeniFormEnd=inString(iformStart,strDiv)-1while iFormStart < iFormEndiStart=inString(iFormStart,"name=""")iEnd=inString(iStart+6,"""")mFormName=subString(iStart+6,iEnd-iStart-6)iFileNameStart=inString(iEnd+1,"filename=""")if iFileNameStart>0 and iFileNameStart<iFormEnd theniFileNameEnd=inString(iFileNameStart+10,"""")mFileName=subString(iFileNameStart+10,iFileNameEnd-iFileNameStart-10)iStart=inString(iFileNameEnd+1,vbEnter&vbEnter)iEnd=inString(iStart+4,vbEnter&strDiv)if iEnd>iStart thenmFileSize=iEnd-iStart-4elsemFileSize=0end ifset theFile=new FileInfotheFile.FileName=getFileName(mFileName)theFile.FilePath=getFilePath(mFileName)theFile.FileSize=mFileSizetheFile.FileStart=iStart+4theFile.FormName=FormNamefile.add mFormName,theFileelseiStart=inString(iEnd+1,vbEnter&vbEnter)iEnd=inString(iStart+4,vbEnter&strDiv) if iEnd>iStart thenmFormValue=subString(iStart+4,iEnd-iStart-4)elsemFormValue="" end ifform.Add mFormName,mFormValueend if iFormStart=iformEnd+iDivLeniFormEnd=inString(iformStart,strDiv)-1wendEnd Sub Private Function subString(theStart,theLen)dim i,c,stempupfile_5xSoft_Stream.Position=theStart-1stemp=""for i=1 to theLenif upfile_5xSoft_Stream.EOS then Exit forc=ascB(upfile_5xSoft_Stream.Read(1))If c > 127 Thenif upfile_5xSoft_Stream.EOS then Exit forstemp=stemp&Chr(AscW(ChrB(AscB(upfile_5xSoft_Stream.Read(1)))&ChrB(c)))i=i+1elsestemp=stemp&Chr(c)End IfNextsubString=stempEnd function Private Function inString(theStart,varStr)dim i,j,bt,theLen,strInString=0Str=toByte(varStr)theLen=LenB(Str)for i=theStart to upfile_5xSoft_Stream.Size-theLenif i>upfile_5xSoft_Stream.size then exit Functionupfile_5xSoft_Stream.Position=i-1if AscB(upfile_5xSoft_Stream.Read(1))=AscB(midB(Str,1)) thenInString=ifor j=2 to theLenif upfile_5xSoft_Stream.EOS then inString=0Exit forend ifif AscB(upfile_5xSoft_Stream.Read(1))<>AscB(MidB(Str,j,1)) thenInString=0Exit Forend ifnextif InString<>0 then Exit Functionend ifnextEnd Function Private Sub Class_Terminate form.RemoveAllfile.RemoveAllset form=nothingset file=nothingupfile_5xSoft_Stream.closeset upfile_5xSoft_Stream=nothingEnd Sub Private function GetFilePath(FullPath)If FullPath <> "" ThenGetFilePath = left(FullPath,InStrRev(FullPath, "\"))ElseGetFilePath = ""End IfEnd function Private function GetFileName(FullPath)If FullPath <> "" ThenGetFileName = mid(FullPath,InStrRev(FullPath, "\")+1)ElseGetFileName = ""End IfEnd function Private function toByte(Str)dim i,iCode,c,iLow,iHightoByte=""For i=1 To Len(Str)c=mid(Str,i,1)iCode =Asc(c)If iCode<0 Then iCode = iCode + 65535If iCode>255 TheniLow = Left(Hex(Asc(c)),2)iHigh =Right(Hex(Asc(c)),2)toByte = toByte & chrB("&H"&iLow) & chrB("&H"&iHigh)ElsetoByte = toByte & chrB(AscB(c))End IfNextEnd functionEnd Class Class FileInfodim FormName,FileName,FilePath,FileSize,FileStartPrivate Sub Class_Initialize FileName = ""FilePath = ""FileSize = 0FileStart= 0FormName = ""End Sub Public function SaveAs(FullPath)dim dr,ErrorChar,iSaveAs=1if trim(fullpath)="" or FileSize=0 or FileStart=0 or FileName="" then exit functionif FileStart=0 or right(fullpath,1)="/" then exit functionset dr=CreateObject("Adodb.Stream")dr.Mode=3dr.Type=1dr.Openupfile_5xSoft_Stream.position=FileStart-1upfile_5xSoft_Stream.copyto dr,FileSizedr.SaveToFile FullPath,2dr.Closeset dr=nothing SaveAs=0end functionEnd Class</SCRIPT>save.asp<% dim dsn,conndsn="driver={sql server};server=127.0.0.1;uid=sa;pwd=;database=database"set conn=server.createobject("adodb.connection")conn.open dsn%><% dim file,file1,file2file=trim(request.form("myface"))file1=trim(request.form("myface1"))file2=trim(request.form("myface2"))set rs=server.createobject("adodb.recordset")sql="Insert Into sFile(image,image1,image2) Values(''"& file &"'',''"& file1&"'',''"& file2&"'')" conn.execute(sql)response.redirect "ok.asp"%> |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
