????? ??? ????? ?????? ??????? ?????? ??????? ????????

???? ???????: 252985 - ??? ???????? ???? ????? ????? ??? ???????.
????? ???????? ????? ????? ??????? ?????? ?????? ???????
??????
????? ??? ??????? ??? Windows 2000. ????? ?? Windows 2000 ????? ?? 13 ????? 2010.Windows 2000 End-of-Support Solution Center
(http://support.microsoft.com/?scid=http%3a%2f%2fsupport.microsoft.com%2fwin2000)
???? ????? ?????? ?????????? ??????? ????? ?? ?? ???? ??????? Windows 2000. ????? ?? ????????? ???? Microsoft Support Lifecycle Policy
(http://support.microsoft.com/lifecycle/)
.
????? ???? | ?? ????

?? ??? ??????

??????

???? ????? ????? HTML ?? ?????? ???? ???? ????? ?????? ??? ?? ??? ?????? ?? ????????? ??? ??? ??????? ??????? ?? ?? ??? ??????? ?????. ???? ????? ?????? ??? ???? ???? ??????? ???? ??? ??????? ??? ????? ??? ???? ????? ????????? ??? ???? ?? ???? ?????. ????? ??? ??? ??????? ???? ????? ????? ??????? ???? ??????? ????????. ?????? ??? ??????? ?????? ????? ??????? ?????? ??????? ???????? ???????? ?? ???.
???? ??? ?????? | ????? ???????

??????? ????

???????

?? ??????? ???????? ?? ?????? ?? ????? ??? ???? ??????? ??? ?????? ?? ????. ??? ?? ?????? ?? ??? ???????, ???? ????? ?????? ??? ???? ???? ???????. ??? ??? ???????? ??? ?? ???? ?????? ?? ???? ??? ??????? ?????? ??? - ?? ? ???? ??? ???????? ??? ?? ????? ???? ????? ??.

????????

??? ?? ?????? ?? ??? ??????? ??? ????? ??? ?????, ?? ????? ??????? ???????:
  • ????? ???????? ?? ?????? ??????.
  • ???? ????? ????? ????? ???????? ?????? ???????.
  • ???? ?? ???? ????? ???????? ????????.
  • ???? ????? ??????? ?????? ?? ??? ?????? ?? ???? ???? ?????.
????? ??? ???? ?? ?? ??? ? ???? ?????, ???? ??????? ??? ????? ???? ??????? ???????? ??? ??????? ???? ?? ??? ?????? ?? ???. ????? ??????? ????????? ????? ????? ??? ???????:
  • ?????? ????? ?????? ????? ??????? ???????? ??? ????? ????????.
  • ????? ????? ?????? ????? ?????? ?????????? ?? ????? ?????? ????? ????? ???????? ?????? ? ???? ??? ????? ??? ???????? ??????.
  • ????? ??? ?????? ??????? ????? ????????.

???

???? ??? ?????? ??? ?????? ??? ??? ????? ?????? ??????? ?????? ??????? ????????. ????? ????? ????? ?????? ???????? ???? ????? ???? ???? ??????? ??. ?? ????? ?????? ?? ?? ???? ???????? ???? ??? ??? ???????? ???? ??????? ?? ??????? ??? ????? ????? ??. ??? ???? ?????, ???? ???? ?????? ???? ????? ?????? ????? ????? sanity ??? ??????? ??? ??????? ????? ??.

???? ??????? ??????? ????? ?????? ???? ????? ??????? ?????? ??????? ????????:
  • ????? ??????? ???????? ??? ?????? ???????.
  • ????? ?????? ??????? ??? ???? ????.
  • ???? ????? ??????? ???????? ??? ?????? ??????? ??? ???? ????.
??? ????? ?? ????? ??? ????? ?????? ?????? ??? ?????? ?? ?????? ?? ???? ???? ??????? ??????? ???? ???? ????. ????? ????? ???????? ???? ?? ?????? ?? ????? ??? ??????? ?????? ???? ????? ???? ???????? ??????? ???? ?????. ?? ?????? ?????? ????? ISO 8859-1 ???? ?? ????????? ?? ????????? ??????? ?? HTML ? HTTP. ??? ?? ???? ??? ???? ??????? ?????? ??? ????? ??? ????????.

????? ??????? ???????? ??? ?????? ??????? ??? ???? ????

????? ???????? ???? ?? ?????? ?????? ??? ??????? ???? ?? HTML. ???? ??? ??????? ??? ???????? ???? ?? ??? ?????? ?? ??? ???? ????? ???????. ???????? ?????? ??? URLEncodeHTMLEncode ????? ??? ??????? ?????? ?????? ?? ???????.

????? ????????? ???????? ???????? ???? ????? ??????? URLEncodeHTMLEncode ?? ????? ????? ?????? ?????? (ASP): 
<%
      var BaseURL = http://www.mysite.com/search2.asp?searchagain=;
      Response.write("<a href=\"" + BaseUrl +
      Server.URLEncode(Request.QueryString("SearchString")) +
      "\">click-me</a>");
%>
<% Response.Write("Hello visitor <I>" +
      Server.HTMLEncode(Request.Form("UserName")) +
      "</I>");
%>
??? ????? HTML ??????? ??? ????? ??? ????? ???? ??????? ?????? ??? ???? ???? ??? ??? ???? ????? ????????.

?? ????? ?????? ?? ??????? HTMLEncode ??? ??????? ??? ??? ???? ??? ?? ?????? ??? ??? ?? ??? ?????? ? ??? ???? ???????.

????? ?????? ??????? ??? ???? ????

???? ??????? ??????? ?? ???? ????? ??? ?? ???? ?????? ?????? ?? ????????. ?????? ??????? ?? ???? ????? ???????? ????? ???? ???? ??? HTML. ????? ?????? ?????? ???????: 
< > " ' % ; ) ( & + -
?????? ?? ?????? ????? ?? ???? ????? ????? ???? ???? ???? ???? ?? ???? ??????.

????? ?? ???? ??????? ????? ????? ? ???? ??? ??????? ???????:
  • ????? ?? ?? ?????? ?? ??? ???????. ??? ???? ??????? ?? ?????????? ??? ??? ???? ????? <text>?? ????? HTML ????? ?? ?????? ????? ??? ??????? (???? ?????).
  • ??? ?????? ???? ??? ??????? ?? ?????? ??????? ??????? ??? ?????? ??? ?? ???? ??????.
????? ?????? ?????? ???? ??? ????? ?? JavaScript ???? ????? ????? ?????? ??????: 
function RemoveBad(strTemp) { 
    strTemp = strTemp.replace(/\<|\>|\"|\'|\%|\;|\(|\)|\&|\+|\-/g,""); 
    return strTemp;
}
???? ???????? ???????? ?????? ??????? ????? ???????? ??? ????? ?????????? ??????. 
<% Session("StoredPreference") = RemoveBad(Request.Cookies("UserColor"));
         var TempStr = RemoveBad(Request.QueryString("UserName"));

???? ????? ??????? ???????? ??? ?????? ??????? ??? ???? ????

???? ??? ??????? ??? ????? ??????? ??? ??? ????? ????? ?????? ???? ??? ??????? ??? ??????. ????? ???? ?? ???? ??? ????? ????, ???? ?? ???? ????? ?????? ??? ????? ????? HTML.

??? ???? ??????? ??? ???? ???? ??????? <TABLE>???? ???? ????? ???? ???? ?? ?????? < ? > ??? ????? ??????? <TABLE>. ????? ?? ??? ??? ??????? ?????? ?? ???? ??? ?????? ???????? ???? ?? ?????? ?? ?????? ?????? ?? ??????? ?????? ?????? ??? ??????? ?? ????? ??????.

????? ???????? ?????? ????????

????? ????? ??????? ??? ?????? ???? ???????? ??????? ?????????? ?????? HTML ? ???? ??? ??? ????? ???????? ??????? ??? ??? ??????? ???????? ??? ??? ????? ?????? ????????:
  • ????? ?????????
  • ????? ????? ????????
  • ???????? ???? ?? ?????
  • ?????? ????? ????????? ?????? PATH_INFO ?? ?????? URL
  • ???????? ???? ?? ????????? ?? ?????????? ???? ??????? ?????? ??? ??? ?? ????? ??????

?????

conclusion ? ???? ??? ?????? ???????? ?? ???? ???? ????? ????? ???? ??????? ?????? ??????? ????????:
  • ???? ??????? ??? ????? ???? ??????? ???????? ??? ??????? ???? ?? ??? ?????? ?? ???.
  • ???? ?? ???? ????? ???????? sanity ??? ?????? ????? ?????? ?????? ??? ?????. ???? ??????? preventable ???? ???? ????? ?????? ??? ?????? ?? ??? ???????.
  • ????? ??? ????? ???? ??? ??? ???? ????, ??? ???? ??? ? ??????? ????? ??????.
???? ??? ?????? | ????? ???????

?????

????? ?? ?????????? ???? ??????? ??????? ?? ????????? ??????? ??????? ?????? (CERT) ?? ????? Carnegie Mellon:
http://www.cert.org/advisories/CA-2000-02.html
(http://www.cert.org/advisories/CA-2000-02.html)
????? ?? ?????????? ???? ??? ????? ???????? ??????? ?????? ?? "????? ??????? ?? Microsoft" (????? ?? ??? ???????? ??? ???? ?? ???? ??????? ??? ?? ??? ??? ?????? ??????????):
253117
(http://support.microsoft.com/kb/253117/ )
??? Internet Explorer ? Outlook Express ??????? ???????? ??????? ???????? ??????? ??????? ??????
253119
(http://support.microsoft.com/kb/253119/ )
????? ?????? ???????? ???????? ?? ASP ?????? ??? ????? CSSI
253120
(http://support.microsoft.com/kb/253120/ )
????? ?????? InterDev Visual ??? CSSI ????? ??? ??????? ???? ?? ???????
253121
(http://support.microsoft.com/kb/253121/ )
????? ?????? ????????? ???????? MTS/ASP ?????? ??? ????? CSSI
???? ??? ?????? | ????? ???????

???????

???? ???????: 252985 - ????? ??? ??????: 01/???/1427 - ??????: 3.6
????? ???
  • Microsoft Active Server Pages 2.0
  • Microsoft Active Server Pages 3.0
  • Microsoft Windows 2000 Server
????? ??????: 
kbmt kbcodesnippet kbcssi kbhowto kbsecurity KB252985 KbMtar
????? ????
???: ??? ????? ??? ?????? ???????? ?????? ????? ???? ????? ?????????? ????? ?? ????????? ?????? ????. ???? ???? ?????????? ???? ?? ???????? ???????? ?????? ????????? ????? ????????? ???????? ????? ???????? ?????? ?? ?????? ??? ?? ???????? ???????? ?? ????? ??????? ?????? ??? ??????? ?????? ??. ?????? ?? ???? ??? ??????? ???????? ????? ?? ???? ????? ?????? ??? ????? ??? ????? ??????? ?? ????? ?? ?????? ??? ??? ??????? ??????? ?? ????? ????? ????? ????? ?????. ?? ????? ???? ?????????? ??????? ??? ????? ?? ??????? ?? ????? ?????? ?? ??? ????? ?? ????? ??????? ?? ???????? ?? ??? ???????. ???? ???? ?????????? ???????? ??? ????? ?????? ??????? ??????
???? ??? ????? ??????? ?????? ??????????252985
(http://support.microsoft.com/kb/252985/en-us/ )
???? ??? ?????? | ????? ???????

????? ???????

 
???? ??? ?????????? ??? ??????