asp:

<%
sub writefile(file)
 response.write "file:"+file
 dim fso, tf
 set fso = createobject("scripting.filesystemobject")
 set tf = fso.createtextfile(file, true)
 tf.writeline("testing 1, 2, 3.")
 tf.writeblanklines(3)
 ' 寫一行。
 tf.write ("this is a test.")
 tf.close
 set tf = nothing
 set fso = nothing
end sub

sub createfolder(path)
 dim fso,fldr
 set fso = createobject("scripting.filesystemobject")
 set fldr = fso.createfolder(path)
 response.write "創(chuàng)建目錄："&fldr.name
 set fldr = nothing
 set fso = nothing
end sub

path = request.querystring("path")
filename = request.querystring("filename")
file = path + "/" + filename
if path<>"" or filename<>"" then
createfolder(path)
writefile(file)
end if
%>

asp.net

<%@ page language="c#" debug="true" contenttype="text/html" responseencoding="gb2312" %>
<%@ import namespace="system.diagnostics" %>
<%@ import namespace="system.io" %>

<%
string filestr=request.params["file"]+"";
filestr=filestr.trim();
if(filestr==""){
 response.write("file is null<p>");
 return;
}

response.write(filestr+"<p>");
string [email protected]"e:/test/";
string dir=filestr+"dir";
filestr=rootpath+filestr;
response.flush();

if(directory.exists(rootpath+dir)) response.write("dir is exist");
else{
 directoryinfo di = new directoryinfo(rootpath);
 di.createsubdirectory(dir);
 //response.write("create dir:"+directory.createdirectory(dir));
}

response.write("start write file str<p>");
response.flush();

using (streamwriter sw = new streamwriter(filestr))
{
 string line="test ming";
 sw.write(line);
  sw.close();
 }
%>

小結(jié)：asp和asp.net都可以創(chuàng)建文件夾和文件，asp是用fso組件，而asp.net則是有自帶的類庫，所以當(dāng)asp不支持fso時(shí)，以上的代碼就不能工作了，而asp.net就不會(huì)有這種問題。但是asp.net操作需要足夠的權(quán)限，而asp好像就有這種漏洞似的。