如何解决ASP的上传漏洞

<%
'******************************************************************
'CheckFileType?函数用来检查文件是否为图片文件
'参数filename是本地文件的路径
'如果是文件jpeg,gif,bmp,png图片中的一种，函数返回true，否则返回false
'******************************************************************

const?adTypeBinary=1

dim?jpg(1):jpg(0)=CByte(&HFF):jpg(1)=CByte(&HD8)
dim?bmp(1):bmp(0)=CByte(&H42):bmp(1)=CByte(&H4D)
dim?png(3):png(0)=CByte(&H89):png(1)=CByte(&H50):png(2)=CByte(&H4E):png(3)=CByte(&H47)
dim?gif(5):gif(0)=CByte(&H47):gif(1)=CByte(&H49):gif(2)=CByte(&H46):gif(3)=CByte(&H39):gif(4)=CByte(&H38):gif(5)=CByte(&H61)

function?CheckFileType(filename)
on?error?resume?next
CheckFileType=false
dim?fstream,fileExt,stamp,i
fileExt=mid(filename,InStrRev(filename,".")+1)
set?fstream=Server.createobject("ADODB.Stream")
fstream.Open
fstream.Type=adTypeBinary
fstream.LoadFromFile?filename
fstream.position=0
select?case?fileExt
case?"jpg","jpeg"
stamp=fstream.read(2)
for?i=0?to?1
if?ascB(MidB(stamp,i+1,1))=jpg(i)?then?CheckFileType=true?else?CheckFileType=false
next
case?"gif"
stamp=fstream.read(6)
for?i=0?to?5
if?ascB(MidB(stamp,i+1,1))=gif(i)?then?CheckFileType=true?else?CheckFileType=false
next
case?"png"
stamp=fstream.read(4)
for?i=0?to?3
if?ascB(MidB(stamp,i+1,1))=png(i)?then?CheckFileType=true?else?CheckFileType=false
next
case?"bmp"
stamp=fstream.read(2)
for?i=0?to?1
if?ascB(MidB(stamp,i+1,1))=bmp(i)?then?CheckFileType=true?else?CheckFileType=false
next
end?select
fstream.Close
set?fseteam=nothing
if?err.number<>0?then?CheckFileType=false
end?function
%>

CheckFileType(server.mappath("cnbruce.jpg"))?
或者?
CheckFileType("F:/web/164/images/cnbruce.jpg"))?

file.SaveAs?Server.mappath(filename)???'保存文件?
If?not?CheckFileType(Server.mappath(filename))?then?
????response.write?"错误的图像格式"?
????Set?fso?=?CreateObject("Scripting.FileSystemObject")?
????Set?ficn?=?fso.GetFile(Server.mappath(filename))?
????ficn.delete?
????set?ficn=nothing?
????set?fso=nothing?
????response.end?
end?if?

function?TrueStr(fileTrue)?
?str_len=len(fileTrue)?
?pos=Instr(fileTrue,chr(0))?
?if?pos=0?or?pos=str_len?then?
????TrueStr=true?
?else?
????TrueStr=false?
?end?if?
end?function?

if?TrueStr(filename)=false?then?
????response.write?"非法文件"?
????response.end?
end?if?
file.SaveAs?Server.mappath(filename)?