ASP - SQL Injection and XSS Cross

 
Function SQLInjection(str) 

Dim resultStr
resultStr = str 

resultStr = Replace(resultStr, ";", " ")
resultStr = Replace(resultStr, "@variable", " ")
resultStr = Replace(resultStr, "@@variable", " ")
resultStr = Replace(resultStr, "+", " ")
resultStr = Replace(resultStr, "print", " ")
resultStr = Replace(resultStr, "set", " ")
resultStr = Replace(resultStr, "%", " ")
resultStr = Replace(resultStr, "<script>", " ")
resultStr = Replace(resultStr, "<SCRIPT>", " ")
resultStr = Replace(resultStr, "script", " ")
resultStr = Replace(resultStr, "SCRIPT", " ")
resultStr = Replace(resultStr, "or", " ")
resultStr = Replace(resultStr, "union", " ")
resultStr = Replace(resultStr, "and", " ")
resultStr = Replace(resultStr, "insert", " ")
resultStr = Replace(resultStr, "openrowset", " ")
resultStr = Replace(resultStr, "xp_", " ")
resultStr = Replace(resultStr, "decare", " ")
resultStr = Replace(resultStr, "select", " ")
resultStr = Replace(resultStr, "update", " ")
resultStr = Replace(resultStr, "delete", " ")
resultStr = Replace(resultStr, "shutdown", " ")
resultStr = Replace(resultStr, "drop", " ")
resultStr = Replace(resultStr, "--", " ")
resultStr = Replace(resultStr, "/*", " ")
resultStr = Replace(resultStr, "*/", " ")
resultStr = Replace(resultStr, "XP_", " ")
resultStr = Replace(resultStr, "DECLARE", " ")
resultStr = Replace(resultStr, "SELECT", " ")
resultStr = Replace(resultStr, "UPDATE", " ")
resultStr = Replace(resultStr, "DELETE", " ")
resultStr = Replace(resultStr, "INSERT", " ")
resultStr = Replace(resultStr, "SHUTDOWN", " ")
resultStr = Replace(resultStr, "DROP", " ")

SQLInjection = removeXSS(resultStr)

End Function


Function removeXSS(str) 

Dim resultVal
resultVal = str 

resultVal = Replace(resultVal, "&", "&amp;") 
resultVal = Replace(resultVal, "<xmp", "<x-xmo", 1, -1, 1) 
resultVal = Replace(resultVal, "javascript", "<x-javascript", 1, -1, 1) 
resultVal = Replace(resultVal, "script", "<x-script", 1, -1, 1) 
resultVal = Replace(resultVal, "iframe", "<x-iframe", 1, -1, 1) 
resultVal = Replace(resultVal, "document", "<x-document", 1, -1, 1) 
resultVal = Replace(resultVal, "vbscript", "<x-vbscript", 1, -1, 1) 
resultVal = Replace(resultVal, "applet", "<x-applet", 1, -1, 1) 
resultVal = Replace(resultVal, "embed", "<x-embed", 1, -1, 1) 
resultVal = Replace(resultVal, "object", "<x-object", 1, -1, 1) 
resultVal = Replace(resultVal, "frame", "<x-frame", 1, -1, 1) 
resultVal = Replace(resultVal, "grameset", "<x-grameset", 1, -1, 1) 
resultVal = Replace(resultVal, "layer", "<x-layer", 1, -1, 1) 
resultVal = Replace(resultVal, "bgsound", "<x-bgsound", 1, -1, 1) 
resultVal = Replace(resultVal, "alert", "<x-alert", 1, -1, 1) 
resultVal = Replace(resultVal, "onblur", "<x-onblur", 1, -1, 1) 
resultVal = Replace(resultVal, "onchange", "<x-onchange", 1, -1, 1) 
resultVal = Replace(resultVal, "onclick", "<x-onclick", 1, -1, 1) 
resultVal = Replace(resultVal, "ondblclick","<x-ondblclick", 1, -1, 1) 
resultVal = Replace(resultVal, "enerror", "<x-enerror", 1, -1, 1) 
resultVal = Replace(resultVal, "onfocus", "<x-onfocus", 1, -1, 1) 
resultVal = Replace(resultVal, "onload", "<x-onload", 1, -1, 1) 
resultVal = Replace(resultVal, "onmouse", "<x-onmouse", 1, -1, 1) 
resultVal = Replace(resultVal, "onscroll", "<x-onscroll", 1, -1, 1) 
resultVal = Replace(resultVal, "onsubmit", "<x-onsubmit", 1, -1, 1) 
resultVal = Replace(resultVal, "onunload", "<x-onunload", 1, -1, 1) 
resultVal = Replace(resultVal, "<", "&lt;")
resultVal = Replace(resultVal, ">", "&gt;")

removeXSS = resultVal

End Function

출처 : https://blog.minov.co.kr/entry/ASP-SQL-Injection-XSS-Cross-%EB%B0%A9%EC%A7%80-%EC%BD%94%EB%93%9C

HTML - 엑셀 다운로드 시 한글 깨짐 현상 (여러가지 처리 방법)

<ASP - euc-kr 기준>

[#1]

<meta http-equiv="content-type" content="application/vnd.ms-excel; charset=euc-kr">

or
<meta http-equiv="content-type" content="text/html; charset=euc-kr"> 

[#2]

Response.Buffer = True

Response.CharSet = "euc-kr"

'Response.CacheControl = "public"

Response.ContentType = "application/vnd.ms-excel"

Response.AddHeader "Content-Disposition", "attachment;filename=엑셀파일명.xls"

[#3]

Session.CodePage = 949

<ASP - utf-8 기준>

[#1]

<meta http-equiv="Content-Language" content="ko">

FileName = Server.urlEncode("한글깨짐방지")

or

FileName = Server.URLPathEncode("한글깨짐방지")

<C# 기준>

[#1]

<meta name="viewport" http-equiv="Content-Type" content="text/html; charset=utf-8" />

or

<meta name="viewport" http-equiv="Content-Type" content="text/html; charset=euc-kr" />

[#2]

Response.Charset = "euc-kr";   

Response.ContentType = "application/vnd.ms-excel"; 

Response.ContentEncoding = System.Text.Encoding.GetEncoding("euc-kr"); 

[#3]

Response.Clear();

Response.ClearHeaders();

Response.Buffer = true;

Response.AddHeader("content-disposition", "attachment; filename=" + "파일명_" + DateTime.Now.ToString("yyyy_MM_dd") + ".xls");

Response.Charset = "utf-8";

Response.ContentType = "application/vnd.xls";

 

string table = @"<Table><tr><td>111</td></tr><tr><td>222</td></tr></Table>";

Response.Write(table);

Response.End();