使用ASP和ASP.NET来创建文件夹和文件。

asp:

<%
sub writefile(file)
 response.write "file:"+file
 dim fso, tf
 set fso = createobject("scripting.filesystemobject")
 set tf = fso.createtextfile(file, true)
 tf.writeline("testing 1, 2, 3.")
 tf.writeblanklines(3)
 ' 写一行。
 tf.write ("this is a test.")
 tf.close
 set tf = nothing
 set fso = nothing
end sub

sub createfolder(path)
 dim fso,fldr
 set fso = createobject("scripting.filesystemobject")
 set fldr = fso.createfolder(path)
 response.write "创建目录："&fldr.name
 set fldr = nothing
 set fso = nothing
end sub

path = request.querystring("path")
filename = request.querystring("filename")
file = path + "/" + filename
if path<>"" or filename<>"" then
createfolder(path)
writefile(file)
end if
%>

asp.net

<%@ page language="c#" debug="true" contenttype="text/html" responseencoding="gb2312" %>
<%@ import namespace="system.diagnostics" %>
<%@ import namespace="system.io" %>

<%
string filestr=request.params["file"]+"";
filestr=filestr.trim();
if(filestr==""){
 response.write("file is null<p>");
 return;
}

response.write(filestr+"<p>");
string [email protected]"e:/test/";
string dir=filestr+"dir";
filestr=rootpath+filestr;
response.flush();

if(directory.exists(rootpath+dir)) response.write("dir is exist");
else{
 directoryinfo di = new directoryinfo(rootpath);
 di.createsubdirectory(dir);
 //response.write("create dir:"+directory.createdirectory(dir));
}

response.write("start write file str<p>");
response.flush();

using (streamwriter sw = new streamwriter(filestr))
{
 string line="test ming";
 sw.write(line);
  sw.close();
 }
%>

小结：asp和asp.net都可以创建文件夹和文件，asp是用fso组件，而asp.net则是有自带的类库，所以当asp不支持fso时，以上的代码就不能工作了，而asp.net就不会有这种问题。但是asp.net操作需要足够的权限，而asp好像就有这种漏洞似的。