防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ZUkrJ'  
mVSaC  
试试这两种方法: '4T]=s~N  
第一种： {\r1A  
squery=lcase(Request.ServerVariables("QUERY_STRING")) mN!5JZ'2  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) G1:*F8q  
%.NOQ<@W  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" {c#{dT
 
GS<aXh k  
SQL_inj = split(SQL_Injdata,"|") -Hx._I$l  
/,tQdD&  
For SQL_Data=0 To Ubound(SQL_inj) e9F\U   
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then ,JLY oE+  
Response.Write "SQL通用防注入系统" hny(:Dj  
Response.end E/<5JhI9~  
end if q?9x0L  
next X+R?>xq{=h  
R)[ l3  
~|FKl%  
49e~/YY  
第二种： NWNPq"  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 7 Ud  
J )148/  
SQL_inj = split(SQL_Injdata,"|") Nt>wzPd)  
"OdR"M(G\  
If Request.QueryString<>"" Then &5x ]9   
For Each SQL_Get In Request.QueryString Q')0 T>F-  
For SQL_Data=0 To Ubound(SQL_inj) KS9eV  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then QH)uh"  
Response.Write "SQL通用防注入系统" uU|fCwQt  
Response.end 
P7X':  
end if ^GS,4[)H  
next PkqOBU*|=  
Next J2vaKl  
End If b* AL,n?  
u'm[wjCjc  
If Request.Form<>"" Then 31FQ=(K  
For Each Sql_Post In Request.Form \v*WI)]  
For SQL_Data=0 To Ubound(SQL_inj) 4R;6u[a]u  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then Q?1' JF!G  
Response.Write "SQL通用防注入系统" ! u4'1jd[d  
Response.end Eps2  
end if Za5bx,^   
next r@|{mQOxa  
next mbZS J  
end if G`Ix-dADJm  
=P,h5
J  
第三种 N:_U2[V^d  
<% ox}LC,!  
'--------定义部份------------------ CyWaXp65  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr gG>|5R0  
'自定义需要过滤的字串,用 "■"分离 7aV(tMzd  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" SK>*t KY  
'---------------------------------- 2O*(F>>dT  
%> >3{l"SPU  
qi ;X_\v  
<% #]vy`rv  
Str_Inf = split(Str_In,"■") 7GyJmzEE  
'--------POST部份------------------ dx<KZR$!V  
If Request.Form<>"" Then PX5K-|R  
For Each Str_Post In Request.Form H&yK{0H  
%wc=Mf  
For Str_Xh=0 To Ubound(Str_Inf) Ah|,`0dw  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then x|TLMu=3=  
'--------写入数据库----------头----- G"xa"hGF  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ,j'>}'wG)  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 9=-d/y?  
Str_db.open Str_dbstr `.0WK  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") 4a]$4LQV  
Str_db.close I_h8)W  
Set Str_db = Nothing ]O\m(of R  
'--------写入数据库----------尾----- [r)Hm/_=|U  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" '`+GC9VG  
Response.Write "非法操作！系统做了如下记录:<br>" !8z,}HUdK  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 
XAnN<  
Response.Write "操作时间："&Now&"<br>" B\tP{}P8{  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" C2Pw;iK_t  
Response.Write "提交方式：POST<br>" ^hMJNy&R  
Response.Write "提交参数："&Str_Post&"<br>"  ]V`L\  
Response.Write "提交数据："&Request.Form(Str_Post) mvCH$}w8&  
Response.End 2a\?Q|1C  
End If Z^fkv  
Next Cq< a|t  
2G(RQ\Ro*  
Next &4m\``//9  
End If Ki8]+W37  
'---------------------------------- ZQ0R3=52r  
i6.HR?n  
'--------GET部份------------------- O.9r'n4f  
If Request.QueryString<>"" Then 2v;F@fUB.  
For Each Str_Get In Request.QueryString e*zt;SR  
ipIexv1/S  
For Str_Xh=0 To Ubound(Str_Inf) M?3Nh;  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then :*/'W5iM  
'--------写入数据库----------头----- @77%15_Jz  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ]P5|V4FXo  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") p>O>^ R  
Str_db.open Str_dbstr Hxw 7Q?F  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") 4dd]Ju  
Str_db.close YpGG^;M$  
Set Str_db = Nothing $;1TP|  
'--------写入数据库----------尾----- iaq+#k@V  
d/m.VnW  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" *[Q
FIDn:  
Response.Write "非法操作！系统做了如下记录:<br>" }H> }v/  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" C `>1x`n  
Response.Write "操作时间："&Now&"<br>" =Eh~ wm  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 3=)!9;uY  
Response.Write "提交方式：GET<br>" sXpA^pT"T  
Response.Write "提交参数："&Str_Get&"<br>" BnB]]<gO"  
Response.Write "提交数据："&Request.QueryString(Str_Get) 3fb"1z#  
Response.End w7;,+Jq  
End If `!JcQ'u  
Next @5C! `:f  
Next v&8%t 7|  
End If 0fpxr`  
%>  /uyZ[=5  
第3中方法需要你自己建个数据库表