防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ +H<%)Lk J  
%!.rP  
试试这两种方法: )i! )Tv  
第一种： 1~`gfHI4  
squery=lcase(Request.ServerVariables("QUERY_STRING")) G,"$Erx  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) p>}N9v;Bo  
k6Tpaf^  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" JR<R8+@g_  
_^'k_a  
SQL_inj = split(SQL_Injdata,"|") 0N T3  
2PeI+!7s  
For SQL_Data=0 To Ubound(SQL_inj) uk'<9g^  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then 8 dZH&G@;  
Response.Write "SQL通用防注入系统" JnsXEkM)  
Response.end b6/:reH{  
end if oNCDG|8z  
next rLKDeB  
41uSr 1  
e1/|PgT(KM  
U_8I$v-~  
第二种： wUV%NZB  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 0~S<}N  
&0C!P=-p  
SQL_inj = split(SQL_Injdata,"|") fglZjT  
6nq.~
f2`  
If Request.QueryString<>"" Then 57MoO  
For Each SQL_Get In Request.QueryString v'@LuF'e8  
For SQL_Data=0 To Ubound(SQL_inj) W@S9}+wl*  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then EEo+#  
Response.Write "SQL通用防注入系统" Y-{spTI  
Response.end cEQa 6  
end if 11-uJVO~*  
next x4( fW\  
Next L+kS8D<  
End If ih;TQ!c+b  
*{Z!m@?  
If Request.Form<>"" Then Fh/C{cX9g  
For Each Sql_Post In Request.Form /6.b>|zF
 
For SQL_Data=0 To Ubound(SQL_inj) B+Bv(p  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then v*^2[pf  
Response.Write "SQL通用防注入系统" (@#Lk"B  
Response.end G7=8*@q>:  
end if AN1bfF:C  
next '#Fh J%x  
next L%8"d6   
end if '
{u#:TTj  
0,3 ':Df  
第三种 Lul?@>T  
<% H Z}'W<N  
'--------定义部份------------------ nm~  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr O0l;
Qi  
'自定义需要过滤的字串,用 "■"分离 jXDo!a|4y  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare"  Uh8ieb  
'---------------------------------- Qv=Z  
%> W2B=%`sC  
p}!pT/KmpH  
<% d!X?R}  
Str_Inf = split(Str_In,"■") U{}7:&As  
'--------POST部份------------------ ^R$dG[Qf  
If Request.Form<>"" Then 1`AE]  
For Each Str_Post In Request.Form $.cGRz
 
N|)V/no6  
For Str_Xh=0 To Ubound(Str_Inf) lKwcT!Q4  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 3// v{ce1]  
'--------写入数据库----------头----- lyeoSd1AN  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" >k#aB.6  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") "|%fAE  
Str_db.open Str_dbstr t 8+93,*B  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") [aC9v
Eso!  
Str_db.close [eN{
Ft0x  
Set Str_db = Nothing fh 3 6  
'--------写入数据库----------尾----- ;(,Fe/wvC  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" %jf gncW  
Response.Write "非法操作！系统做了如下记录:<br>" #e=^-yE  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" syfR5wc  
Response.Write "操作时间："&Now&"<br>" }<S2W\,G  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" !{XO#e  
Response.Write "提交方式：POST<br>" &ivIv[LV  
Response.Write "提交参数："&Str_Post&"<br>" 4>HGwk@+8  
Response.Write "提交数据："&Request.Form(Str_Post) igL^k`&5^"  
Response.End ?(=
B=a[  
End If R{B~Now3  
Next tSYn c7  
o
u- ;k }  
Next 1GdgF? 4  
End If ?C{N0?[P-  
'---------------------------------- K!~ ](_W!  
qTGy\i  
'--------GET部份------------------- TDGzXJf[  
If Request.QueryString<>"" Then TExlGAHo+O  
For Each Str_Get In Request.QueryString aKy|$ {RC  
zK92:+^C  
For Str_Xh=0 To Ubound(Str_Inf) OR9){qP  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then f*~fslY,o  
'--------写入数据库----------头----- jdp: G  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" B;Z^.3  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") "F}Ip&]hAG  
Str_db.open Str_dbstr t*#&y:RG  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") cOgtBEhn  
Str_db.close E=QQZ\w  
Set Str_db = Nothing DIAP2LR ?  
'--------写入数据库----------尾----- e-CW 4x  
rY= #^S  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" *S4P'JSY  
Response.Write "非法操作！系统做了如下记录:<br>" c%!wKoD  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" yB1>83!q  
Response.Write "操作时间："&Now&"<br>" B=r/(
e  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" AVWrD[ wD2  
Response.Write "提交方式：GET<br>" 9 JtG&^*  
Response.Write "提交参数："&Str_Get&"<br>" qh 3f  
Response.Write "提交数据："&Request.QueryString(Str_Get) (jG$M=q-  
Response.End jg8P4s  
End If jFv<]D%A[  
Next :[39g;V}c  
Next GZt] 38V)g  
End If g1|c?#fwo  
%> g <o;\\  
第3中方法需要你自己建个数据库表