ASP Request
QueryString / Form / Cookies / ServerVariables / ClientCertificate 五个集合。
五个集合
| Collection | Source | Example |
|---|---|---|
QueryString | ?a=1&b=2 | Request.QueryString("a") |
Form | POST 请求体 | Request.Form("name") |
Cookies | 请求头 Cookie | Request.Cookies("theme") |
ServerVariables | 请求头与服务器信息 | Request.ServerVariables("REMOTE_ADDR") |
ClientCertificate | SSL 客户端证书 | 很少用 |
QueryString
<%
' /page.asp?id=42&tag=asp&tag=web
Response.Write Request.QueryString("id") & "<br>"
Response.Write Request.QueryString("tag").Count & " 个 tag<br>"
Response.Write Request.QueryString("tag")(1) & "<br>"
' 遍历所有参数
Dim k
For Each k In Request.QueryString
Response.Write k & " = " & Request.QueryString(k) & "<br>"
Next
%>42
2 个 tag
asp
id = 42
tag = asp, webWhen a parameter repeats, Request.QueryString("tag") returns asp, web; index (0), (1) for individual values. Use .Count instead of assuming a single value.
ServerVariables
<%
Response.Write "客户端 IP：" & Request.ServerVariables("REMOTE_ADDR") & "<br>"
Response.Write "请求方法：" & Request.ServerVariables("REQUEST_METHOD") & "<br>"
Response.Write "请求路径：" & Request.ServerVariables("PATH_INFO") & "<br>"
Response.Write "查询串：" & Request.ServerVariables("QUERY_STRING") & "<br>"
Response.Write "User-Agent：" & Request.ServerVariables("HTTP_USER_AGENT") & "<br>"
Response.Write "来源页：" & Request.ServerVariables("HTTP_REFERER") & "<br>"
Response.Write "服务器名：" & Request.ServerVariables("SERVER_NAME")
%>客户端 IP：203.0.113.42
请求方法：GET
请求路径：/page.asp
查询串：id=42
User-Agent：Mozilla/5.0 ...
来源页：https://example.com/list
服务器名：www.example.comHeaders appear with an HTTP_ prefix and - replaced by _: User-Agent becomes HTTP_USER_AGENT. A few such as CONTENT_TYPE and CONTENT_LENGTH have no prefix.
拿真实客户端 IP
<%
Function ClientIP()
Dim ip
ip = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If ip = "" Then ip = Request.ServerVariables("REMOTE_ADDR")
' X-Forwarded-For 可能是 "客户端, 代理1, 代理2"
If InStr(ip, ",") > 0 Then ip = Trim(Split(ip, ",")(0))
ClientIP = ip
End Function
%>Behind a proxy or CDN, REMOTE_ADDR is the proxy's address; the real client is the first value in X-Forwarded-For. That header can be forged, so trust it only when your proxy overwrites it.
安全提醒
<%
' 危险：直接拼进 SQL
sql = "SELECT * FROM users WHERE name = '" & Request.Form("name") & "'"
' 危险：直接输出到 HTML
Response.Write Request.Form("comment")
' 安全：转义后输出
Response.Write Server.HTMLEncode(Request.Form("comment"))
' 安全：参数化查询（见 ADO 章节）
%>Request is user-controlled: concatenating into SQL is injection, printing is XSS, concatenating into a path is traversal. Validate or escape before use.读取原始请求体
<%
Dim body
body = Request.BinaryRead(Request.TotalBytes)
%>BinaryRead reads the raw body (useful for JSON) but cannot be mixed with Request.Form: once the raw body is read the Form collection is empty. Pick one.
五个集合
| 集合 | 来源 | 示例 |
|---|---|---|
| URL 参数 | ?a=1&b=2 | Request.QueryString("a") |
| 表单 | POST 请求体 | Request.Form("name") |
| Cookie | 请求头 Cookie | Request.Cookies("theme") |
| 服务器变量 | 请求头与服务器信息 | Request.ServerVariables("REMOTE_ADDR") |
| 客户端证书 | SSL 客户端证书 | 很少用 |
QueryString
<%
' /page.asp?id=42&tag=asp&tag=web
Response.Write Request.QueryString("id") & "<br>"
Response.Write Request.QueryString("tag").Count & " 个 tag<br>"
Response.Write Request.QueryString("tag")(1) & "<br>"
' 遍历所有参数
Dim k
For Each k In Request.QueryString
Response.Write k & " = " & Request.QueryString(k) & "<br>"
Next
%>42
2 个 tag
asp
id = 42
tag = asp, web同名参数出现多次时，Request.QueryString("tag") 返回 asp, web（逗号拼接），(0)、(1) 取单个。用 .Count 判断个数，别假设只有一个。
ServerVariables
<%
Response.Write "客户端 IP：" & Request.ServerVariables("REMOTE_ADDR") & "<br>"
Response.Write "请求方法：" & Request.ServerVariables("REQUEST_METHOD") & "<br>"
Response.Write "请求路径：" & Request.ServerVariables("PATH_INFO") & "<br>"
Response.Write "查询串：" & Request.ServerVariables("QUERY_STRING") & "<br>"
Response.Write "User-Agent：" & Request.ServerVariables("HTTP_USER_AGENT") & "<br>"
Response.Write "来源页：" & Request.ServerVariables("HTTP_REFERER") & "<br>"
Response.Write "服务器名：" & Request.ServerVariables("SERVER_NAME")
%>客户端 IP：203.0.113.42
请求方法：GET
请求路径：/page.asp
查询串：id=42
User-Agent：Mozilla/5.0 ...
来源页：https://example.com/list
服务器名：www.example.com请求头在 ServerVariables 里统一加 HTTP_ 前缀并把 - 换成 _：User-Agent → HTTP_USER_AGENT。少数例外如 CONTENT_TYPE、CONTENT_LENGTH 没有前缀。
拿真实客户端 IP
<%
Function ClientIP()
Dim ip
ip = Request.ServerVariables("HTTP_X_FORWARDED_FOR")
If ip = "" Then ip = Request.ServerVariables("REMOTE_ADDR")
' X-Forwarded-For 可能是 "客户端, 代理1, 代理2"
If InStr(ip, ",") > 0 Then ip = Trim(Split(ip, ",")(0))
ClientIP = ip
End Function
%>经过反向代理或 CDN 后，REMOTE_ADDR 是代理的 IP。真实地址在 X-Forwarded-For 的第一个值里——但这个头可以伪造，只有在代理会覆盖它时才可信。
安全提醒
<%
' 危险：直接拼进 SQL
sql = "SELECT * FROM users WHERE name = '" & Request.Form("name") & "'"
' 危险：直接输出到 HTML
Response.Write Request.Form("comment")
' 安全：转义后输出
Response.Write Server.HTMLEncode(Request.Form("comment"))
' 安全：参数化查询（见 ADO 章节）
%>Request 的每一个值都是用户可控的。拼 SQL 就是注入，直接输出就是 XSS，拼进文件路径就是目录穿越。任何来自 Request 的字符串，用之前都要过一遍校验或转义。读取原始请求体
<%
Dim body
body = Request.BinaryRead(Request.TotalBytes)
%>BinaryRead 能读原始请求体（比如接收 JSON），但不能与 Request.Form 混用——读了原始体之后 Form 集合就空了。二选一。