首先判断文件大小:
if file.filesize<10 then Response.Write("<script>alert('您没有选择上传文件')</script>") Response.Write("<script>history.go(-1)</script>") Response.End() end if
将文件上传到服务器后,判断用户文件中的危险操作字符:
set MyFile = server.CreateObject("Scripting.FileSystemObject") set MyText = MyFile.OpenTextFile(FilePath, 1) '读取文本文件 sTextAll = lcase(MyText.ReadAll) MyText.close set MyFile = nothing sStr=".getfolder|.createfolder|.deletefolder|.createdirectory|.deletedirectory|.saveas |wscript.shell|script.encode|server.|.createobject|execute|activexobject|language=" sNoString = split(sStr,"|") for i=0 to ubound(sNoString) if instr(sTextAll,sNoString(i)) then set filedel = server.CreateObject("Scripting.FileSystemObject") filedel.deletefile FilePath set filedel = nothing Response.Write("<script>alert('您上传的文件有问题,上传失败');window.close();</script>") Response.End() end if next