text's blog

003

整理ASP过滤HTML代码

<%

function htmlcheck(htmlstring)
htmlstring = replace(htmlstring,"<","&lt")
htmlstring = replace(htmlstring,">","&gt")
htmlstring = replace(htmlstring,"&","&amp")
htmlstring = replace(htmlstring,"  ","&nbsp&nbsp")
htmlstring = replace(htmlstring,"chr(10)","<br>")
htmlcheck = htmlstring
end function

%>

用的时候是<%=htmlcheck(rs("message"))%>，比如输入<b>test</b>显示的时候就备替换为:
&ltb&gttest&lt/b&gt

asp html代码过滤 写法一

<%
Function FilterHTML(strToFilter)
  Dim strTemp
  strTemp = strToFilter
  While Instr(1,strTemp,"<") AND Instr(1, strTemp, ">")
    strTemp = Left(strTemp, Instr(1, strTemp, "<")-1) & Right(strTemp, Len(strTemp)-Instr(1,strTemp, ">"))
  WEnd
  FilterHTML = strTemp
End Function
%>

asp html代码过滤 写法二

 <% public Function RemoveHTML(strHTML)
  ON ERROR RESUME NEXT
  Dim objRegExp, strOutput
    Set objRegExp = New Regexp
    objRegExp.IgnoreCase = True
    objRegExp.Global = True
    objRegExp.Pattern = "<.+?>"
    strOutput = objRegExp.Replace(strHTML, "")
    strOutput = Replace(strOutput, "<", "〈")
    strOutput = Replace(strOutput, ">", "〉")
    RemoveHTML = strOutput  
    Set objRegExp = Nothing
 End Function %>

写法二通用.

1. <script>标记中包含的代码
2. <a href=javascript:...中的代码
3. 其它基本控件的 on...事件中的代码
4. iframe 和 frameset 中载入其它页面造成的攻击
有了这些资料后，事情就简单多了，写一个简单的方法，用正则表达式把以上符合几点的代码替换掉:
public string wipescript(string html)
{
system.text.regularexpressions.regex regex1 = new system.text.regularexpressions.regex(@"<script[\s\s]+</script *>",system.text.regularexpressions.regexoptions.ignorecase);
system.text.regularexpressions.regex regex2 = new system.text.regularexpressions.regex(@" href *= *[\s\s]*script *:",system.text.regularexpressions.regexoptions.ignorecase);
system.text.regularexpressions.regex regex3 = new system.text.regularexpressions.regex(@" on[\s\s]*=",system.text.regularexpressions.regexoptions.ignorecase);
system.text.regularexpressions.regex regex4 = new system.text.regularexpressions.regex(@"<iframe[\s\s]+</iframe *>",system.text.regularexpressions.regexoptions.ignorecase);
system.text.regularexpressions.regex regex5 = new system.text.regularexpressions.regex(@"<frameset[\s\s]+</frameset *>",system.text.regularexpressions.regexoptions.ignorecase);
html = regex1.replace(html, ""); //过滤<script></script>标记
html = regex2.replace(html, ""); //过滤href=javascript: (<a>) 属性
html = regex3.replace(html, " _disibledevent="); //过滤其它控件的on...事件
html = regex4.replace(html, ""); //过滤iframe
html = regex5.replace(html, ""); //过滤frameset
return html;
}

Tags:HTML  函数