防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ Z $Fm73  
@1s 2#)l(  
试试这两种方法: ){4!  
第一种： n;e.N:p  
squery=lcase(Request.ServerVariables("QUERY_STRING")) GTke<R  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) +%R{j|8#  
y
q12"Rs  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" O96%U$W  
y'C
  
SQL_inj = split(SQL_Injdata,"|") z[WdJN{  
6e%ZNw{#=  
For SQL_Data=0 To Ubound(SQL_inj) wL[{6wL  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then x9\]C'*sO  
Response.Write "SQL通用防注入系统" ]JHInt  
Response.end l7#2 e ORm  
end if 2]cU:j6G  
next +}iuTqu5  
Q!{,^Qb  
6"yIk4u:  
YI?tmqzt  
第二种： yOO@v6jO)  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" sp6A*mwl  
Y2}m/7aF  
SQL_inj = split(SQL_Injdata,"|") 5DL(#9F8b9  
L wcAF g|  
If Request.QueryString<>"" Then *_@$"9  
For Each SQL_Get In Request.QueryString P c'\  
For SQL_Data=0 To Ubound(SQL_inj) ht2J, 1t  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then 3|BB#;  
Response.Write "SQL通用防注入系统"
,:8oVq>?  
Response.end RV)
,E:?  
end if upiYo(sN.  
next ^#]eCXv  
Next e\.  
End If xu.TS  
cUr5x8<W).  
If Request.Form<>"" Then cnB:bQQK8  
For Each Sql_Post In Request.Form X*t2h3"}  
For SQL_Data=0 To Ubound(SQL_inj) %xdyGAl:  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then NIG* }[}P  
Response.Write "SQL通用防注入系统" dy4~~~^A  
Response.end G UK%RC8  
end if W1ql[DqE{  
next yH0vESgv  
next g\pLQH  
end if aSIoq}c(  
+S@[1 N  
第三种 %ZX3:2  
<% IQQ>0^Q~  
'--------定义部份------------------ R%"'k<`#  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr Hb\['VhzM  
'自定义需要过滤的字串,用 "■"分离 )i<Qg.@MX  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" Z@0IvI  
'----------------------------------  ?%*p!m  
%> ufJHC06  
oB+Ek~{z]  
<% Qn}M  
Str_Inf = split(Str_In,"■") b?:?"  
'--------POST部份------------------ b1yS1i D  
If Request.Form<>"" Then ]j]
<CqG  
For Each Str_Post In Request.Form @#yl_r%  
nI/kX^Pd  
For Str_Xh=0 To Ubound(Str_Inf) [Xww`OUsh  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then >]kZ2gVt  
'--------写入数据库----------头----- Fi# 9L  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" \zhCGDm1_  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") &;U F,  
Str_db.open Str_dbstr ,fvhP $n  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") U "v=XK)!  
Str_db.close 1z_1Hl  
Set Str_db = Nothing v.c.5@%%o  
'--------写入数据库----------尾----- omI"xx  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" py6O\` \  
Response.Write "非法操作！系统做了如下记录:<br>" 'rrnTd c  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" oz7=1;r  
Response.Write "操作时间："&Now&"<br>" XI"IEwB  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" l7U<]i GL  
Response.Write "提交方式：POST<br>" kNX8y--  
Response.Write "提交参数："&Str_Post&"<br>" tg
7QX/KX  
Response.Write "提交数据："&Request.Form(Str_Post) zICrp  
Response.End g|M>C:ZT  
End If ,_@) IN  
Next tv 5N wM  
ld#YXJ;P.k  
Next e^v\K [  
End If {Rn*)D9  
'---------------------------------- +1c[!;'  
(&M,rW~Qxs  
'--------GET部份------------------- iYGa4@/uM  
If Request.QueryString<>"" Then jWso'K  
For Each Str_Get In Request.QueryString |][PbN D  
\_7'f  
For Str_Xh=0 To Ubound(Str_Inf) Nzb=h/;  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then HahA} Q  
'--------写入数据库----------头----- 2Hk21y\  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" " "S&zN  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") le6eorK8  
Str_db.open Str_dbstr ;8w CQ  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") gi+FL_8CzU  
Str_db.close ?O0,)hro  
Set Str_db = Nothing d}wE4(]b  
'--------写入数据库----------尾----- lU.aDmy<  
r(<91~Ww  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" @ eYD@!  
Response.Write "非法操作！系统做了如下记录:<br>" o;>qsn8  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" J)sOne  
Response.Write "操作时间："&Now&"<br>" I_|W'%N]  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" %!R\-Vej  
Response.Write "提交方式：GET<br>" Nhtc^DX  
Response.Write "提交参数："&Str_Get&"<br>" lDVgW}o@  
Response.Write "提交数据："&Request.QueryString(Str_Get) fC/P W`4Ae  
Response.End -i]2b  
End If B^.:dn  
Next MRzY<MD  
Next +NoVe#  
End If *r  ('A  
%> df/7u}>9  
第3中方法需要你自己建个数据库表