防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ -A>1L@N  
8V%(SV  
试试这两种方法: c *(
]pM  
第一种： 4"fiEt,t<x  
squery=lcase(Request.ServerVariables("QUERY_STRING")) 8Letpygm  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) `d,hP"jBc  
|s :b9sfA  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" }tT"vCu  
r{.DRbn  
SQL_inj = split(SQL_Injdata,"|") 2E^zQ>;01  
[G^ir  
For SQL_Data=0 To Ubound(SQL_inj) 0[g8  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then ^1M:wXr  
Response.Write "SQL通用防注入系统" k/W$)b:Of`  
Response.end NrVrR80Y  
end if b
>AFhj:  
next _ 97  
0t<]Uf  
'u$e2^  
WR=e$;  
第二种： QT/ TZ:  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" r#wMd9])  
A, rgN;5fb  
SQL_inj = split(SQL_Injdata,"|") GcQO&oq|  
M@S6V7  
If Request.QueryString<>"" Then zJS,f5L6)  
For Each SQL_Get In Request.QueryString 3!^5a%u   
For SQL_Data=0 To Ubound(SQL_inj) pS vDH-  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ]%m0PU#  
Response.Write "SQL通用防注入系统" Z[ }0K3,5  
Response.end .WA
(X5  
end if d ! A)H<Zt  
next ZKyK#\v<  
Next Af5O;v\  
End If =jjUwcl  
f_X]2in  
If Request.Form<>"" Then MK7S*N1  
For Each Sql_Post In Request.Form /w{DyHT  
For SQL_Data=0 To Ubound(SQL_inj) w@7NoD=  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then #*;(%\q}  
Response.Write "SQL通用防注入系统" >bWsUG9  
Response.end stz1e dP  
end if Bo8+uRF|  
next FLJdnL  
next =Nwm hV  
end if  ]L4B  
Q@hx+aM  
第三种 Yw<K!'C
  
<% C)/uX5  
'--------定义部份------------------ dIe-z7x  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr Y[9x\6 _E  
'自定义需要过滤的字串,用 "■"分离 TjGe8L:  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" <#JJS}TLk  
'---------------------------------- $QmP' <  
%> a0OH  
$;Lb|~  
<% wxEFM)z
r  
Str_Inf = split(Str_In,"■") g<O*4 ]=  
'--------POST部份------------------ .?9+1.`
 
If Request.Form<>"" Then  3}}~ (  
For Each Str_Post In Request.Form l@nkR&4[  
"0Uh(9Fv  
For Str_Xh=0 To Ubound(Str_Inf) Ia$&SS)K  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then _, /m  
'--------写入数据库----------头----- P9vN5|"M  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" x(h(a#,r  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") I&qT3/SVI  
Str_db.open Str_dbstr +Ck F#H ~  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") O`U&0lKi'  
Str_db.close 6*Jd8Bva\o  
Set Str_db = Nothing ~hPp)-A  
'--------写入数据库----------尾----- ^Afq)26D  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" &mDKpYrB  
Response.Write "非法操作！系统做了如下记录:<br>" (L_txd4  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 0l!%}E  
Response.Write "操作时间："&Now&"<br>" ;|e{J$  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ]kx)/n-K  
Response.Write "提交方式：POST<br>" D`PnY&ffT  
Response.Write "提交参数："&Str_Post&"<br>" 'n%Ac&kk  
Response.Write "提交数据："&Request.Form(Str_Post) &}31q`  
Response.End 4UmTA_& Io  
End If nk9Kq\2f:  
Next Zso&.IATng  
Ha9A5Ao}0  
Next 2628
c`  
End If iD#HBo  
'---------------------------------- !1K<iz_8  
RRig  
'--------GET部份------------------- t<sg8U.  
If Request.QueryString<>"" Then h"cLZM:6  
For Each Str_Get In Request.QueryString ]0.? 1se  
"*|plB  
For Str_Xh=0 To Ubound(Str_Inf) gP1~N^hke]  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then Es6b ~#  
'--------写入数据库----------头----- \ Xow#@[  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" &Al9%W  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ao>bn RXR  
Str_db.open Str_dbstr aN{C86wx  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") _In[Z?P}  
Str_db.close kVE% "  
Set Str_db = Nothing  (-DA%  
'--------写入数据库----------尾----- |3W\^4>,  
Px5ArSS  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" |ZW%+AQ|   
Response.Write "非法操作！系统做了如下记录:<br>" u}hQF$a"  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" !fr /WxJ  
Response.Write "操作时间："&Now&"<br>" ^%wj6  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" l j*ELy  
Response.Write "提交方式：GET<br>" z|[#6X6tT  
Response.Write "提交参数："&Str_Get&"<br>" iJuh1+6:c9  
Response.Write "提交数据："&Request.QueryString(Str_Get) a
W]!$  
Response.End od!"?F  
End If YG$2ySkDhE  
Next j7=I!<w V  
Next >lQ&^9EI%  
End If K <7# ;  
%> h[72iVn  
第3中方法需要你自己建个数据库表