ASP Server
Server 的 CreateObject / MapPath / HTMLEncode / URLEncode / Execute / Transfer。
成员一览
| Member | Purpose |
|---|---|
CreateObject | ADODB.Connection、Scripting.FileSystemObject 等 |
MapPath | /data/a.mdb → C:\inetpub\...\data\a.mdb |
HTMLEncode | < → <，防 XSS |
URLEncode | 中文与特殊字符编码 |
Execute | 在当前页执行另一个 .asp |
Transfer | 转到另一个页，保留 request 上下文 |
ScriptTimeout | 最长执行秒数 |
GetLastError | 自定义错误处理时读错误对象 |
CreateObject
<%
Dim fso, conn, dict
Set fso = Server.CreateObject("Scripting.FileSystemObject")
Set conn = Server.CreateObject("ADODB.Connection")
Set dict = Server.CreateObject("Scripting.Dictionary")
' 用完置 Nothing，让 COM 对象尽早释放
Set dict = Nothing
Set conn = Nothing
Set fso = Nothing
%>Set is required for object assignment; fso = ... raises "object variable not set". Assign Nothing when done — the page end would release it anyway, but large objects benefit from early release.
MapPath
<%
Response.Write Server.MapPath("/") & "<br>"
Response.Write Server.MapPath("/data/app.mdb") & "<br>"
Response.Write Server.MapPath("list.asp")
%>C:\inetpub\wwwroot\
C:\inetpub\wwwroot\data\app.mdb
C:\inetpub\wwwroot\products\list.aspMapPath converts a web path to a physical path, which all file operations need. A leading / means the site root; otherwise it is relative to the current page's directory.
HTMLEncode 与 URLEncode
<%
Dim raw
raw = "<script>alert(1)</script>"
Response.Write Server.HTMLEncode(raw) & "<br>"
Response.Write Server.URLEncode("中文 参数&x=1")
%><script>alert(1)</script>
%D6%D0%CE%C4+%B2%CE%CA%FD%26x%3D1HTMLEncode is the basic XSS defence: <, >, & and " become entities and the browser shows them as text. URLEncode is for building URLs with Chinese parameters.
HTMLEncode only protects HTML context. Inside <script>, an onclick attribute or href="javascript:..." it does nothing; those contexts need entirely different handling.Execute 与 Transfer
<%
' Execute：在当前页执行另一个页，共享变量
Server.Execute "part.asp"
' Transfer：转到另一个页，后续代码不执行，URL 不变
Server.Transfer "done.asp"
%>Execute inlines the other page and returns; Transfer hands over and never comes back. Neither changes the address bar, unlike Response.Redirect.
超时控制
<%
Server.ScriptTimeout = 300 ' 最多执行 300 秒
%>The default is 90 seconds. Long exports and imports need more, but do not set it unlimited: a stuck request holds a worker thread, and a few dozen can take the site down.
成员一览
| 成员 | 用途 |
|---|---|
| 创建对象 | ADODB.Connection、Scripting.FileSystemObject 等 |
| 虚拟转物理 | /data/a.mdb → C:\inetpub\...\data\a.mdb |
| HTML 转义 | < → <，防 XSS |
| URL 转义 | 中文与特殊字符编码 |
| 执行页面 | 在当前页执行另一个 .asp |
| 转移 | 转到另一个页，保留 request 上下文 |
| 脚本超时 | 最长执行秒数 |
| 取错误 | 自定义错误处理时读错误对象 |
CreateObject
<%
Dim fso, conn, dict
Set fso = Server.CreateObject("Scripting.FileSystemObject")
Set conn = Server.CreateObject("ADODB.Connection")
Set dict = Server.CreateObject("Scripting.Dictionary")
' 用完置 Nothing，让 COM 对象尽早释放
Set dict = Nothing
Set conn = Nothing
Set fso = Nothing
%>Set 是必须的——对象赋值要用 Set，直接 fso = ... 会报「对象变量未设置」。用完 Set x = Nothing 能提前释放，页面结束虽然也会释放，但大对象尽早放手更好。
MapPath
<%
Response.Write Server.MapPath("/") & "<br>"
Response.Write Server.MapPath("/data/app.mdb") & "<br>"
Response.Write Server.MapPath("list.asp")
%>C:\inetpub\wwwroot\
C:\inetpub\wwwroot\data\app.mdb
C:\inetpub\wwwroot\products\list.aspMapPath 把 Web 路径转成服务器上的物理路径，文件操作全靠它。以 / 开头是站点根，否则相对当前页面目录。
HTMLEncode 与 URLEncode
<%
Dim raw
raw = "<script>alert(1)</script>"
Response.Write Server.HTMLEncode(raw) & "<br>"
Response.Write Server.URLEncode("中文 参数&x=1")
%><script>alert(1)</script>
%D6%D0%CE%C4+%B2%CE%CA%FD%26x%3D1HTMLEncode 是防 XSS 的基本手段：把 <、>、&、" 换成实体，浏览器就当文字显示。URLEncode 用于拼接带中文的 URL 参数。
HTMLEncode 只对 HTML 上下文有效。把用户输入拼进 <script> 里、onclick 属性里、或 <a href="javascript:..."> 里，编码是挡不住的——那些上下文需要完全不同的处理方式。Execute 与 Transfer
<%
' Execute：在当前页执行另一个页，共享变量
Server.Execute "part.asp"
' Transfer：转到另一个页，后续代码不执行，URL 不变
Server.Transfer "done.asp"
%>Execute 像「内联展开」，执行完回到当前页继续；Transfer 像 forward，交出去就不回来了。两者都不改变浏览器地址栏，和 Response.Redirect 不同。
超时控制
<%
Server.ScriptTimeout = 300 ' 最多执行 300 秒
%>默认 90 秒。导出大报表、批量导入这类操作需要调大，但别无限放大——一个卡住的请求会一直占着工作线程，几十个就能把站点拖死。