加密QueryString数据 -pc6资讯

您的位置：首页 → 技术开发 → ASP技巧 → 加密QueryString数据

加密QueryString数据 时间：2004/11/7 4:10:00来源：本站整理作者：蓝点我要评论(0)

　　Problem with Query String Method

　　Often time we use query string collection to retrieve an unique record from a table. Notice the following

　　piece of code -

　　Detail.asp?RecordID=200

　　Here we are passing a query string value called "RecordID" using the url. We then use the Query String collection "RecordID" to get the actual number -

　　Dim RecordID

　　RecordID = Request.QueryString("RecordID")

　　The problem with the above method is that we are exposing "RecordID" to the public. Hence making easy to hackers to just change the RecordID Query string to retrieve other values of the table.

　　Solution to the above problem

　　In order to solve the above problem, we will use two ASP pages and the ASP random number function to scramble the passing query string value so that the real record number is not exposed to others.

　　On the first page we get a random number with the following code -

　　Randomize timer

　　' Randomizing the timer function

　　rndNum = abs(int((rnd() * 3001)))

　　' To generate a prime based, non-negative random number..

　　rndNum = rndNum + 53

　　Session("rndNum") = rndNum

　　'We place the random number value in a session variable so that we can use it again in the next page %>

　　Now that we have our random number we will scramble our query string with it! Here is how -

　　'Assuming you have a record set retrieved -

　　Display_Rs.movefirst

　　While not Display_Rs.Eof

　　Response.Write "<a href=detail.asp?RecordID="

　　Response.Write (Display_Rs("RecordID")*rndNum)

　　' Notice we are multiplying the actual record number with the random number to scramble the query 'string

　　Response.Write Display_Rs("RecordID") & ""

　　Display_Rs.Movenext

　　Wend

　　In the next page we will un-scramble the query string! Here is how -

　　Dim RecordID

　　RecordID = request.querystring("RecordID")/Session("rndNum")

　　' We are dividing the record ID query string value with the formula to un-scramble and pass the

　　actual record ID to the SQL statement

　　Session.abandon

　　' Releasing Session value for the next record

　　That's it! Using the above method you can scramble a query string as much as you like. For example multiply the random number with a very complex formula to generate an even more difficult integer number.

　　The key point here is you divide the number with the formula yielding to the original value. This technique is not full proof but much more difficult to break in that passing a regular query string value.

文章评论

查看所有0条评论>>

热门文章 没有查询到任何记录。