防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ .>@]Im  
}c'T]h\S  
试试这两种方法: b#:!b  
第一种： 'V}4_3#q  
squery=lcase(Request.ServerVariables("QUERY_STRING")) @<B$LJ|jdG  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) w s7LDY&(  
qoOq47F  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" ,pa=OF  
)<_:%oB  
SQL_inj = split(SQL_Injdata,"|") P RN%4G  
@O)1Hnm  
For SQL_Data=0 To Ubound(SQL_inj) g>-u9%aa  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then E*8).'S%k  
Response.Write "SQL通用防注入系统" 47^
7S=  
Response.end ^'$P[  
end if U9h@1:  
next c)zwyBz  
3|0OW Jk  
m=%yZ2F;  
zOMU&;.\  
第二种： t8t+wi!  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" &Tk@2<5=  
FyA0"  
SQL_inj = split(SQL_Injdata,"|") @T~~aQFk  
idNg&'   
If Request.QueryString<>"" Then C ^ Oy.s  
For Each SQL_Get In Request.QueryString og|~:>FmJo  
For SQL_Data=0 To Ubound(SQL_inj) t#=FFQOt  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ?$%2\"wX~7  
Response.Write "SQL通用防注入系统" -{eI6#z|\A  
Response.end lVS.XQ2<  
end if cB}6{c$_sW  
next z&Lcl{<MA  
Next N683!wNX  
End If DTCOhUIV  
#)( D_*  
If Request.Form<>"" Then U46Z~B  
For Each Sql_Post In Request.Form )
OV2CP  
For SQL_Data=0 To Ubound(SQL_inj) n4/Jx*  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then qfyuq]  
Response.Write "SQL通用防注入系统" h2vD*W  
Response.end ihopQb+k^m  
end if D@yu2}F{IY  
next lM[FT=M  
next M[?0 ^ FBx  
end if I5w>*F  
yQ quGu  
第三种 pSS8 %r%S'  
<% 7aeyddpM  
'--------定义部份------------------ 1IWP~G  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr Dh .<&ri
 
'自定义需要过滤的字串,用 "■"分离 {'[S.r`  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" "ac$S9@~  
'---------------------------------- nmUMg  
%> '<&rMn  
w7yz4_:x^  
<% E,7b=t  
Str_Inf = split(Str_In,"■") /t_AiM,(  
'--------POST部份------------------ .a `ojT  
If Request.Form<>"" Then C7_#D O6"  
For Each Str_Post In Request.Form =X=m_\=~@  
NSQ#\:3:S  
For Str_Xh=0 To Ubound(Str_Inf) ![{0Yw D  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 5VGr<i&A  
'--------写入数据库----------头----- 4!DXj0^  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" iKE
Hwm  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") N3?h
u}  
Str_db.open Str_dbstr yn.f?[G2  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") !Q5NV4gd+  
Str_db.close "j?\Ze*  
Set Str_db = Nothing p/'09FY+U  
'--------写入数据库----------尾----- 1ika'  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" }vt>}%%  
Response.Write "非法操作！系统做了如下记录:<br>" swG!O}29OX  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" N_f>5uv  
Response.Write "操作时间："&Now&"<br>" y/!jC]!+c  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" br4 %(w(d  
Response.Write "提交方式：POST<br>" ZGQz@H5  
Response.Write "提交参数："&Str_Post&"<br>" i3o;G"IcD  
Response.Write "提交数据："&Request.Form(Str_Post) ZUaqv  
Response.End 0R}F(tjw  
End If @JpkG%eK  
Next U t.#h="  
f}VIkx]X"  
Next d2Ox:| <)  
End If ,2lH*=m;  
'---------------------------------- hbE~.[Y2r  
0v'!(&m  
'--------GET部份------------------- &v<Am%!N  
If Request.QueryString<>"" Then Oq*=oz^~1  
For Each Str_Get In Request.QueryString .X{U\{c|a  
aX|LEZ;D>  
For Str_Xh=0 To Ubound(Str_Inf) 5ii:93Hlj  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 3}2a3)  
'--------写入数据库----------头----- bSS=<G9  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" \Qei}5P,  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 3Jw}MFFV  
Str_db.open Str_dbstr 6Wc'5t
3  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") Bngvm9k3  
Str_db.close ljJR7<  
Set Str_db = Nothing }TwSSF|}3  
'--------写入数据库----------尾----- HHg[6aw  
TV*@h2C"i  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" oE'Flc.  
Response.Write "非法操作！系统做了如下记录:<br>" - *~~00w  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" jT1^oXn@  
Response.Write "操作时间："&Now&"<br>" z*G(AcS)  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" )UAkg  
Response.Write "提交方式：GET<br>" ,w0Io  
Response.Write "提交参数："&Str_Get&"<br>" "E%3q3|"l  
Response.Write "提交数据："&Request.QueryString(Str_Get) peGh-  
Response.End ;@V1*7y  
End If Yo[Pu< zR  
Next  R]"3^k*  
Next 0M5m8  
End If e~NF}9#A  
%> QLOcgU^  
第3中方法需要你自己建个数据库表