防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ k ,fTW^?  
N`1r;%5  
试试这两种方法: ( 3;`bvYH"  
第一种： v3-?CQb(  
squery=lcase(Request.ServerVariables("QUERY_STRING")) %wL,v.}  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) R|Y~u*D  
6N3@!xtpi  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" &t_h'JX&  
MZ~.(&  
SQL_inj = split(SQL_Injdata,"|") JXm?2/  
/80YZ   
For SQL_Data=0 To Ubound(SQL_inj) 1JeJxzv >C  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then zH=hIVc  
Response.Write "SQL通用防注入系统" tlGWl0V?7Q  
Response.end P 4 6,o  
end if KY+]RxX  
next K\^&+7&zVg  
7zGMkl  
/s`;9)G]9  
x+:zq<0|  
第二种： .$wLLE^*  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" _9kIRmT {  
6mHhC?  
SQL_inj = split(SQL_Injdata,"|") t?3BCm$Mi  
3_zSp
.E\l  
If Request.QueryString<>"" Then d~`-AC+  
For Each SQL_Get In Request.QueryString 2 ~-( A  
For SQL_Data=0 To Ubound(SQL_inj) Ub)M*Cq0(o  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then 5\S&)ZA@  
Response.Write "SQL通用防注入系统" o](.368+4  
Response.end m&Sp1=*Ejy  
end if 4bI*jEc\[  
next #T"64%dX  
Next S
Rf5W'4y  
End If woau'7}XOu  
Pux)>q] C  
If Request.Form<>"" Then * nCx[  
For Each Sql_Post In Request.Form !<r8~A3!(  
For SQL_Data=0 To Ubound(SQL_inj) =l,#iYJP8  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then :e2X/tl#  
Response.Write "SQL通用防注入系统" g+|Bf&_  
Response.end d?7BxYa
a  
end if f3&/r  
next $?f]ZyZr.  
next @vAFfYU9<.  
end if [z+x"9l0!  
gZ`DT  
第三种 |-61(X.  
<% hdj%|~Fj  
'--------定义部份------------------ bl.E IyG>  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr wd+O5Lr.R  
'自定义需要过滤的字串,用 "■"分离 &+- e  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" &7Kb]Ti  
'---------------------------------- 4 z0L ke  
%> 3G d|YRtk  
#r}uin*jD  
<% SqqDV)Uih1  
Str_Inf = split(Str_In,"■") !Uy>eji}  
'--------POST部份------------------ zlk
W U  
If Request.Form<>"" Then 6~@5X}^<0  
For Each Str_Post In Request.Form j38 6gL  
/qXzOd  
For Str_Xh=0 To Ubound(Str_Inf) B_&^ER5j  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then o#}mkE87  
'--------写入数据库----------头----- -tyaE  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" bNs[O22  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") CQ18%w6  
Str_db.open Str_dbstr z!Hx @){|  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") <Uwwux<v  
Str_db.close 6b#~;  
Set Str_db = Nothing |Puj7Ru  
'--------写入数据库----------尾----- P` ]ps?l  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" r|-J8s#  
Response.Write "非法操作！系统做了如下记录:<br>" jw4TLc7p  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" `M]BhW)  
Response.Write "操作时间："&Now&"<br>" }]GbUC!Zb  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" +WLD  
Response.Write "提交方式：POST<br>" <kbnu7?a*  
Response.Write "提交参数："&Str_Post&"<br>" a_%>CD${t  
Response.Write "提交数据："&Request.Form(Str_Post) !.eAOuq  
Response.End b1)\Zi  
End If tN!Bvj:C[M  
Next ~U%j{8uH  
ZIW7_Y>_  
Next 
(hsZ  
End If 1eiw3WU;  
'---------------------------------- kfK[u/<i  
]_#SAhOR)  
'--------GET部份------------------- !NA`g7'  
If Request.QueryString<>"" Then QgZJ`G--  
For Each Str_Get In Request.QueryString 0BDS_Rx  
!gJzg*{u@  
For Str_Xh=0 To Ubound(Str_Inf) 5!h<b3u>]  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then `^e*T'UPl  
'--------写入数据库----------头----- 24X=5Aj  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" +XQPjg  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") G?ZC9w]rA  
Str_db.open Str_dbstr 3+zzi  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") -TZ
^~s  
Str_db.close qc&jd  
Set Str_db = Nothing ?i%nMlcc  
'--------写入数据库----------尾----- 3?^NN|xg  
UR,?!rJ^B  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ?Cc :)  
Response.Write "非法操作！系统做了如下记录:<br>" zq=&4afOE  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" JMePI%#8  
Response.Write "操作时间："&Now&"<br>" vX.]hp5~  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" :D4];d>1  
Response.Write "提交方式：GET<br>" O{BW;Deo  
Response.Write "提交参数："&Str_Get&"<br>" uMpl#N p  
Response.Write "提交数据："&Request.QueryString(Str_Get) 6sy,A~e  
Response.End O! (85rp/  
End If Xi+n`T'i  
Next cNeiD@t3V&  
Next TrQm]9@  
End If nX 8B;*p6b  
%> |D+p$
^L  
第3中方法需要你自己建个数据库表