IE - 某些查询字符串挂起页面
我有一个网站，已经运行良好一段时间了。 最近，任何作为查询字符串（“GET”）传递的包含“SELECT”、“FROM”和“WHERE”字样的表单都会导致页面挂起，并最终给出“页面未找到...”的信息。错误。 看起来这只发生在 IE 上，而不是 Firefox 上，但已通过多个客户端得到证实。 另外，它只发生在一台服务器上......如果我将相同的测试脚本复制到另一台服务器，没有问题。 这些单词不必从表单传递，它们也可以作为查询字符串附加。
例如，
http://www.problemserver.com/qsfails .asp?q=select+from+where 在
出现问题的服务器上失败。 事实上，如果我将“qsfails.asp”替换为不存在的页面名称，页面加载仍然会挂起并等待直到超时，而尝试加载不存在但没有查询字符串的页面会立即得到“找不到页面...”错误。
服务器是否受到威胁？ 托管公司声称事实并非如此。 有人遇到过这种情况吗？ 想法或建议？
谢谢！
I have a site that has worked fine for a while. Recently, any form passed as a querystring ('GET') that has the words "SELECT", "FROM", and "WHERE" in it causes the page to hang and, eventually, give a "Page not found..." error. It looks like this only happens with IE, not Firefox, but has been confirmed using several clients. Also, it only happens on one server...if I copy the same test script to another server, no problem. The words do not have to be passed from a form, they can also just be appened as a querystring.
So, for example,
http://www.problemserver.com/qsfails.asp?q=select+from+where
fails on the server that exhibits the problem. In fact, if I replace 'qsfails.asp' with a page name that does not exist, the page loading still hangs and waits until it times out, whereas trying to load a page that does not exist but without the querystring gets an immediate "Page not found..." error.
Is the server compromised? The hosting company claims it is not. Has anyone ever encountered this? Thoughts or suggestions?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我发现您的 Web 主机正在运行通用过滤器来防止 SQL 注入攻击，例如 UrlScan 。 IIS 和 Apache 都有多个此类工具。 这将阻止您的网站看到或处理该请求。
奇怪的是，他们在你提出问题后并没有提到类似的事情。 与他们核实。
I recon your web host is running a generic filter to prevent SQL injection attacks, like UrlScan. There are several such tools for both IIS and Apache. This will prevent the request from ever being seen or processed by your website.
Strange that they wouldn't mention something like that after your question though. Check with them.
事实证明索拉林是正确的。
我曾询问过安全过滤，但被告知没有。 我再次询问，仍然被告知“不”，托管公司认为这是一个路由问题（这对我来说毫无意义，但我知道什么）。
然而，他们一定是把它踢了，因为他们安装了一个过滤器，这就是问题所在。 不仅客户不知道，甚至他们的前几级技术支持也不知道。 哎呀。
感谢索拉林。
Turns out Thorarin was correct.
I had asked about security filtering but was told no. I asked again and was still told "no", the hosting company thought it was a routing issue (which made no sense to me but what do I know).
However, they must have kicked it up the line because they had installed a filter which was the problem. Not only did customers not know, even their first couple levels of tech support did not know. Oops.
Thanks to Thorarin.