防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ o4|M0  
i_j[?.?X}  
试试这两种方法: {phNd s%  
第一种： KXx32 b,~  
squery=lcase(Request.ServerVariables("QUERY_STRING")) XUz3*rfs  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) &l!4mxwr`  
C?
lcGt!H  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" dBz/7&Q   
Kx>qz.wwI?  
SQL_inj = split(SQL_Injdata,"|")
S: h{2{  
V5UF3'3;}  
For SQL_Data=0 To Ubound(SQL_inj) !\7!3$w'8,  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then |Y?HA&  
Response.Write "SQL通用防注入系统" d3D] k,  
Response.end ;lHr =e7  
end if |S_eDjF  
next 5`~PR :dN  
*MKO I'  
'.:z&gSqx0  
"*In+!K  
第二种： vEJWFoeEFm  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" o,_?^'@  
wne,e's}   
SQL_inj = split(SQL_Injdata,"|") A"L&a l$i  
G3Z)Z)N  
If Request.QueryString<>"" Then f&Gt|  
For Each SQL_Get In Request.QueryString 3kybLOG  
For SQL_Data=0 To Ubound(SQL_inj) vSEuk}pk  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then &L=suDe  
Response.Write "SQL通用防注入系统" !2ZF(@C/  
Response.end D]zwl@sRX:  
end if hb}+A=A=+  
next <0Xf9a8>  
Next 1`=nWy='  
End If 37s0e;aF  
?8'*,bK  
If Request.Form<>"" Then gEy?s8_,  
For Each Sql_Post In Request.Form i<#QW'R(  
For SQL_Data=0 To Ubound(SQL_inj) 4y|BOVl  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then <3LbNFP  
Response.Write "SQL通用防注入系统" Q+[n91ey**  
Response.end MN\HDKN  
end if x(1:s|Uyp{  
next Fld=5B^}  
next 6 (]Dh;gC  
end if yDzc<p\`  
fdFo#P  
第三种 JMC. w!  
<%  y3@H/U{  
'--------定义部份------------------ pFOx>u2`a  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr pR=@S>!|  
'自定义需要过滤的字串,用 "■"分离 V<GHpFi0  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" F1*>y  
'---------------------------------- Q'=x|K#xj  
%> 6^]+[q}3  
b,7k)ND1F  
<% y [}.yyye  
Str_Inf = split(Str_In,"■") T&6l$1J  
'--------POST部份------------------ 0XE4<U  
If Request.Form<>"" Then B38]~'8  
For Each Str_Post In Request.Form u_oaebOrpP  
GS$ifv  
For Str_Xh=0 To Ubound(Str_Inf) g6j?,c|y  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then La`NPY_:>  
'--------写入数据库----------头----- !>FYK}c7  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" C5o#i*|  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") KcWN,!G  
Str_db.open Str_dbstr (A9Fhun  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") wW>A_{Y  
Str_db.close *4\:8  
Set Str_db = Nothing +^60T$  
'--------写入数据库----------尾----- ~vm%6CABM  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" LSL/ZvSP  
Response.Write "非法操作！系统做了如下记录:<br>" "\:`/k3  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" )_YX DU  
Response.Write "操作时间："&Now&"<br>" o#3ly-ht  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" f6hnTbJ  
Response.Write "提交方式：POST<br>"
^aItoJq  
Response.Write "提交参数："&Str_Post&"<br>" marQNZ  
Response.Write "提交数据："&Request.Form(Str_Post) &u$Q4  
Response.End p`olCp'  
End If lXW%FH6c+  
Next ,Vc6Gwm  
gb[5&>(#  
Next 5_GYrR2  
End If bRFLcM  
'---------------------------------- rV` #[d  
3lrT3a3vV  
'--------GET部份------------------- DX#Nf""Pw  
If Request.QueryString<>"" Then ;`0%t$@-  
For Each Str_Get In Request.QueryString A8muQuj]~~  
8\&X2[oAD  
For Str_Xh=0 To Ubound(Str_Inf) we;-~A5J  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then igCZ|Ru\  
'--------写入数据库----------头----- 1m4$p2j  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" YvaK0p0Z  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") fDv2JdiU  
Str_db.open Str_dbstr rB Q_iB_  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')")
-*1d!  
Str_db.close ,LHn90S  
Set Str_db = Nothing j'Fpjt"&=  
'--------写入数据库----------尾----- !|S(Ms  
_>&X\`D  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" L>jY.d2w=K  
Response.Write "非法操作！系统做了如下记录:<br>" {'7B6  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>"  dm\F  
Response.Write "操作时间："&Now&"<br>" (S>C#A=E\  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" q+yQwX{  
Response.Write "提交方式：GET<br>" *& BQTZ6  
Response.Write "提交参数："&Str_Get&"<br>" '$i: 2mn,  
Response.Write "提交数据："&Request.QueryString(Str_Get) )}Hpi<5N  
Response.End V'z1  
End If
3#3n!(  
Next bQgc8
/  
Next 5T
H~.^`Fi  
End If ?+))}J5N\  
%> cuax;0{%  
第3中方法需要你自己建个数据库表