孤影棧

有個網友發問說,如果使word跟excel檔案強制下載,
而不是直接開啟在瀏覽器下.
有另一個網友想知道怎麼防盜連...
而這樣的問題都是可以用Adodb.Stream來解決,
當然,網路上也有一堆已經幫你寫好的程式可以用,
方便到你只要複製貼上就可以用,
如果要加計算次數的功能,也只要加行程式就可以!!

但是你真的有搞懂這程式是怎麼運作的嗎??
你有仔細看過他的流程除了正確外,是不是夠安全??

下面這程式是從網路上抓的,
相信很多人應該也都是用這程式....

download.asp <% Response.Buffer = True Dim strFilePath, strFileSize, strFileName Const adTypeBinary = 1 strFilePath = Request.QueryString("File") strFileSize = Request.QueryString("Size") strFileName = Request.QueryString("Name") Response.Clear Set objStream = Server.CreateObject("ADODB.Stream") objStream.Open objStream.Type = adTypeBinary objStream.LoadFromFile server.mappath(strFilePath) strFileType = lcase(Right(strFileName, 4)) Select Case strFileType Case ".asf" ContentType = "video/x-ms-asf" Case ".avi" ContentType = "video/avi" Case ".doc" ContentType = "application/msword" Case ".zip" ContentType = "application/zip" Case ".xls" ContentType = "application/vnd.ms-excel" Case ".gif" ContentType = "image/gif" Case ".jpg", "jpeg" ContentType = "image/jpeg" Case ".wav" ContentType = "audio/wav" Case ".mp3" ContentType = "audio/mpeg3" Case ".mpg", "mpeg" ContentType = "video/mpeg" Case ".rtf" ContentType = "application/rtf" Case ".htm", "html" ContentType = "text/html" Case ".asp" ContentType = "text/asp" Case Else ContentType = "application/octet-stream" End Select Response.AddHeader "Content-Disposition", "attachment; filename=" & request("File") Response.AddHeader "Content-Length", strFileSize Response.Charset = "UTF-8" Response.ContentType = ContentType Response.BinaryWrite objStream.Read Response.Flush objStream.Close Set objStream = Nothing %>

但是你知道這程式有什麼問題嗎??
假如有個連結是
download.asp?file=download.asp
你可以試試這會抓到什麼東西...
假如在把file=後面改成/index.asp
(假設您的網站有index.asp的話...)
那你應該會發現這程式好玩的地方...
有疑問或是想討論的歡迎回應!!