防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ tRU+6D <w  
3=w$1.B d  
试试这两种方法: {KJ!rT  
第一种： u
,i~,M  
squery=lcase(Request.ServerVariables("QUERY_STRING")) llVm[7  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) >r+Dl\R  
,f0|eu>  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" o33wePx,  
emp*j@9  
SQL_inj = split(SQL_Injdata,"|") @, v'V!  
+92/0
 
For SQL_Data=0 To Ubound(SQL_inj) aw9/bp*N  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then b4`t, D  
Response.Write "SQL通用防注入系统" ql,k5.l  
Response.end ,!U._ic'B  
end if X`kTbIZ|  
next *FoH'\=  
{E*dDv  
*
^R?*vNs  
0M^7#),  
第二种：  qW8sJ=  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 1eue.i uQ  
5Ug.J{d  
SQL_inj = split(SQL_Injdata,"|") {+~}iF<%  
;Z]i$Vi_r  
If Request.QueryString<>"" Then M0[7>N_  
For Each SQL_Get In Request.QueryString ?+-uF}  
For SQL_Data=0 To Ubound(SQL_inj) @~pIyy\_  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then >Micc   
Response.Write "SQL通用防注入系统" =0,:w (Sb!  
Response.end o HqBNTyH  
end if ]?!#*<t r  
next r}k2n s9  
Next 2pR+2p`  
End If Fd@n#DR `  
K F^5 C  
If Request.Form<>"" Then yPG,+uQ$.  
For Each Sql_Post In Request.Form b77
Iw%x7  
For SQL_Data=0 To Ubound(SQL_inj) ;&B;RUUnTO  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then o' Q"  
Response.Write "SQL通用防注入系统" E.
V#Bk=  
Response.end 7:7i}`O  
end if Bw^*6P^l  
next K|Sh  
next 8J nb/A}  
end if x6Q,$B  
S<do.{|p[  
第三种 P|,@En 1!  
<% z~b5K\/1B  
'--------定义部份------------------ $ M?VJ\8
 
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr (tQ#( '(w  
'自定义需要过滤的字串,用 "■"分离 eXo 7_#  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" M*M,Z  
'---------------------------------- cMxuG'{=.  
%> f' |JLhs  
W
k1o H  
<% ug]WIG7 S  
Str_Inf = split(Str_In,"■") #R2wt7vE  
'--------POST部份------------------ aLZza"W  
If Request.Form<>"" Then %JUD54bBt  
For Each Str_Post In Request.Form ^P30g2gv>  
$ ?ayE  
For Str_Xh=0 To Ubound(Str_Inf) t>nx#ErS  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then )l 0\TF  
'--------写入数据库----------头----- RsnK B/  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" -/ 5" Py  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") OV<'v%_&  
Str_db.open Str_dbstr qffVF|7  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") ~>8yJLZ.7  
Str_db.close D#VUx9kugv  
Set Str_db = Nothing 7 lQ@I}i  
'--------写入数据库----------尾----- FbH 1yz  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" Zy!^HS$  
Response.Write "非法操作！系统做了如下记录:<br>" ;+:C  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ?` ?HqR0  
Response.Write "操作时间："&Now&"<br>" klkshlk d  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" u-v/`F2wN  
Response.Write "提交方式：POST<br>" WdQR^'b$  
Response.Write "提交参数："&Str_Post&"<br>" sw<GlF"  
Response.Write "提交数据："&Request.Form(Str_Post) (^h2'uB  
Response.End y8oqCe)  
End If Y3%_IwSJ|  
Next mn5y]:;`  
0\W
6X;?  
Next A7U]wW9  
End If g!/O)X3  
'---------------------------------- Ife/:v  
D==C"}J  
'--------GET部份------------------- ySkz5K+|g  
If Request.QueryString<>"" Then e,J q<=j  
For Each Str_Get In Request.QueryString rQE:rVKVh  
eI20)t`j  
For Str_Xh=0 To Ubound(Str_Inf) ,3+#?H  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then k*xMe-  
'--------写入数据库----------头----- c, IAz  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ~
`Uil=  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 2c)Ez?  
Str_db.open Str_dbstr JDbRv'F:(  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") Whd.AaD\  
Str_db.close 42E%&DF  
Set Str_db = Nothing =r1-M.*a.M  
'--------写入数据库----------尾----- `i~kW  
'YFy6rds  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" yLpsK[)}\  
Response.Write "非法操作！系统做了如下记录:<br>" a]=k-Xh  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 5~,usA*  
Response.Write "操作时间："&Now&"<br>" &YiUhK  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 4$~A%JN3  
Response.Write "提交方式：GET<br>" ,)u1r3@I^  
Response.Write "提交参数："&Str_Get&"<br>" t,D7X1W  
Response.Write "提交数据："&Request.QueryString(Str_Get) l$1 ]  
Response.End Hl"^E*9x  
End If zDD  
Next 7XM:4whw  
Next BIQQJLu  
End If Ja4j7d1:  
%> CdZS"I  
第3中方法需要你自己建个数据库表