<% set upload=new upload_file
if upload.form("act")="uploadfile" then
filepath=trim(upload.form("filepath"))
filelx=trim(upload.form("filelx"))

i=0
for each formName in upload.File
    set file=upload.File(formName)

fileExt=lcase(file.FileExt) '得到的文件扩展名不含有.
if file.filesize<250 then
    response.write "请先选择你要上传的文件！　[ 重新上传 ]"
response.end
end if
if (filelx<>"swf") and (filelx<>"jpg") then 
    response.write "该文件类型不能上传！　[ 重新上传 ]"
response.end
end if
if filelx="swf" then
if fileext<>"swf"    then
    response.write "只能上传swf格式的Flash文件！　[ 重新上传 ]"
    response.end
end if
end if
if filelx="jpg" then
if fileext<>"gif" and fileext<>"jpg"    and fileext<>"bmp" then
    response.write "只能上传jpg、gif、bmp格式的图片！　[ 重新上传 ]"
    response.end
        end if
end if
if filelx="swf" then
if file.filesize>(3000*1024) then
    response.write "最大只能上传 3M 的Flash文件！　[ 重新上传 ]"
    response.end
end if
end if
if filelx="jpg" then
if file.filesize>(250*1024) then
    response.write "最大只能上传 250K 的图片文件！　[ 重新上传 ]"
    response.end
end if
end if

randomize
ranNum=int(90000*rnd)+10000
filename=filepath&session;("useradmin")&"_"&year;(now)&month;(now)&day;(now)&hour;(now)&minute;(now)&second;(now)&ranNum;&"."&fileExt;

if file.FileSize>0 then           ''如果 FileSize > 0 说明有文件数据
    'file.SaveAs Server.mappath(filename)     ''保存文件
    file.SaveToFile Server.mappath(FileName)
    sFile=server.mappath(FileName)
set MyFile=server.CreateObject("Scripting.FileSystemObject")
set MyText=MyFile.OpenTextFile(sFile, 1) '读取文本文件
sTextAll=lcase(MyText.ReadAll)
MyText.close
'判断用户文件中的危险操作
sStr="script <% .getfolder .createfolder .deletefolder .createdirectory .deletedirectory .saveas wscript.shell script.encode"
sNoString=split(sStr," ") 
for i=0 to ubound(sNoString)
if instr(sTextAll,sNoString(i)) then
set filedel=server.CreateObject ("Scripting.FileSystemObject")
filedel.deletefile server.mappath(FileName)
response.write "你的ip和时间已被纪录，由于你曾多次使用该方法对系统进行非法攻击，我们将会把你的数据向广东省公安部及网警报告!"&"攻击IP:"&request.servervariables;("remote_addr")&",攻击时间:"&date;()&" "&time;()
set MyFiletemp=server.CreateObject("Scripting.FileSystemObject")
set wfile=myfiletemp.opentextfile(server.mappath("gjrz.txt"),8)
wfile.writeline date()&" "&time;()&" "&request.servervariables;("remote_addr")
Response.end
end if
next

    'response.write file.FileName&"　　上传成功!　　
"
    'response.write "新文件名："&FileName;&"
"
    'response.write "新文件名已复制到所需的位置，可关闭窗口！"
    if filelx="swf" then
        response.write "<script>window.opener.document."&upload.form;("FormName")&".size.value='"∫(file.FileSize/1024)&" K'</script>"
    end if
    response.write "<script>window.opener.document."&upload.form;("FormName")&"."&upload.form;("EditName")&".value='"&FileName;&"'</script>"
%>
<%end if
set file=nothing
next
set upload=nothing
end if
%>
<script language="javascript" type="text/javascript">
window.alert("文件上传成功!请不要修改生成的链接地址！");
window.close();
</script>



因此只要他上传的文件中含有:<%,script ,encode等等脚本代码或者ASP代码,通通删除上传的文件.并作出警告.即使他把ASP木马加密也难逃被杀的命运.