防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ J(VJMS;_  
*<
zfe.  
试试这两种方法:  u:3~Ius  
第一种： ;2-,Xzz8  
squery=lcase(Request.ServerVariables("QUERY_STRING")) y'pAh dF  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) )avli@W-3j  
AY{caM  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" Y:oL  
R-"A*/A 2  
SQL_inj = split(SQL_Injdata,"|") X4lz?Y:*  
}i./,  
For SQL_Data=0 To Ubound(SQL_inj) diGPTV-?$  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then <MI>>$seiJ  
Response.Write "SQL通用防注入系统" Uo<d]4p $  
Response.end mHUQtGAVQ  
end if cRK1JxU
 
next 4WZ:zr N
 
{?17Zth  
try'%0}>  
~
%B^`s  
第二种： egxh  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" `[w:l[i  
YUat}-S  
SQL_inj = split(SQL_Injdata,"|") 1p<m>s=D=e  
N)03 {$WM  
If Request.QueryString<>"" Then &%}6&PWi  
For Each SQL_Get In Request.QueryString _K3?0<=4  
For SQL_Data=0 To Ubound(SQL_inj) Z~ VOO7|m  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then t0d1??G  
Response.Write "SQL通用防注入系统" *f=H#  
Response.end &[}bHX/  
end if *pCT34'--  
next b'4{l[3~nl  
Next DDyeNuK  
End If g>A*kY  
m@R!
o  
If Request.Form<>"" Then {A2(a7vV  
For Each Sql_Post In Request.Form Tf)qd\  
For SQL_Data=0 To Ubound(SQL_inj) (\>3FwFHW|  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then v{"$:Z ow  
Response.Write "SQL通用防注入系统" (4LXoNT  
Response.end F??})YX  
end if o nt8
q8  
next _$]3&P  
next T$)&8"Xya  
end if ^+^#KC8]W  
$+!/=8R)  
第三种 i<l_z&  
<% H[UV]qO,  
'--------定义部份------------------ p?2\9C4  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 1~Zmc1]  
'自定义需要过滤的字串,用 "■"分离 9^,MC&eb  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" *Fb]lM7D  
'---------------------------------- 5fMVjd  
%> :[|4Zn  
w xKlBx7  
<% fgK1+sW  
Str_Inf = split(Str_In,"■") D |kdk;Xv  
'--------POST部份------------------ GSIRZJl  
If Request.Form<>"" Then F~2bCy[Z  
For Each Str_Post In Request.Form (B{`In8G>y  
_SC{nZ[  
For Str_Xh=0 To Ubound(Str_Inf) gE]6]L  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then OOn{ Wp  
'--------写入数据库----------头----- _]@
  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" )-%3;e<w  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") $8vZi B!"  
Str_db.open Str_dbstr tAO,s ZW  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") '/%]B@!  
Str_db.close (pN:ETB  
Set Str_db = Nothing ]KdSwIbi  
'--------写入数据库----------尾----- DJvmwFx  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" }lt5!u~}  
Response.Write "非法操作！系统做了如下记录:<br>" bfcQ( m5  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" mD<- <]SYp  
Response.Write "操作时间："&Now&"<br>" D^8]+2 r  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 1t wC-rC  
Response.Write "提交方式：POST<br>" Zvz Zs  
Response.Write "提交参数："&Str_Post&"<br>" $(/=Wn  
Response.Write "提交数据："&Request.Form(Str_Post) M?l/_!QB  
Response.End ZxLdh8v.  
End If YE
H /22  
Next 7yM=$"'d  
#m=TK7*v  
Next 82l$]W4  
End If n@xC?D:t*  
'---------------------------------- Yl4XgjG  
S-l<+O1fy  
'--------GET部份------------------- (Ild>_Tdb`  
If Request.QueryString<>"" Then ;c p*]  
For Each Str_Get In Request.QueryString Cp4 U`]  
/.P9n9  
For Str_Xh=0 To Ubound(Str_Inf) =jXBF.  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then .}!"J`{W  
'--------写入数据库----------头----- :}'5'oVG  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" _ p%=RIR  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") h|qT MwPr  
Str_db.open Str_dbstr [qbZp1s|(  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") R8LJC]6Bh  
Str_db.close wV8_O)[  
Set Str_db = Nothing V>D8l @  
'--------写入数据库----------尾----- pURtk-Fr2  
0z&]imU  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" )#S;H$@$  
Response.Write "非法操作！系统做了如下记录:<br>" O(x1Ja,&  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 3L}eFg,d  
Response.Write "操作时间："&Now&"<br>" N~H!6N W  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" K!W7a~ @  
Response.Write "提交方式：GET<br>" 'D_a2xo0  
Response.Write "提交参数："&Str_Get&"<br>" U; -2)+  
Response.Write "提交数据："&Request.QueryString(Str_Get) U )kl!  
Response.End T_iX1blrgh  
End If #&0G$~  
Next rlxZ,

]ul  
Next JBqL0H  
End If b9nTg  
%> : EA-L  
第3中方法需要你自己建个数据库表