防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ zcxG%? Q  
HnY: gu  
试试这两种方法: xFpJ#S&  
第一种： D( h|
r^5  
squery=lcase(Request.ServerVariables("QUERY_STRING")) r5s*"z  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) :"QRB#EC%  
u{H_q&1  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" w~Y#[GW  
4 Qw;r  
SQL_inj = split(SQL_Injdata,"|") 2ZE4^j|  
)9<)mV*EB(  
For SQL_Data=0 To Ubound(SQL_inj) 6PPvfD^  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then !2{MWj  
Response.Write "SQL通用防注入系统" (
>;~((2  
Response.end 6?,r d  
end if }:jXl!:V  
next Q|xPm:  
UI!EI
Z*~  
OmoY] 8N}  
uk\G Am@O  
第二种： .Dx]wv  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" pn =S%Qf]  
n"dT^ g  
SQL_inj = split(SQL_Injdata,"|") gl!3pTC  
X;6X K$"  
If Request.QueryString<>"" Then Q
kF-}P%  
For Each SQL_Get In Request.QueryString Nm;ka&'  
For SQL_Data=0 To Ubound(SQL_inj) _@^msyoq  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then 4e%SF|(Y'h  
Response.Write "SQL通用防注入系统" @l;f'
;+  
Response.end 5@v!wms  
end if wkIH<w|jb  
next [x E\IqwM  
Next ~z< ? Wh  
End If Eydk645:3  
*{
-XN  
If Request.Form<>"" Then ol:_2G2xQ  
For Each Sql_Post In Request.Form DH9?~|  
For SQL_Data=0 To Ubound(SQL_inj) ^3r2Q?d\  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then L1D%vu`  
Response.Write "SQL通用防注入系统" P,>#  
Response.end fqF1-%  
end if MT&i5!Z  
next vkt)!hl `  
next CV& SNA  
end if LXK+W
B/s  
L3kms6ch  
第三种 Y.}n,y|J}  
<% N86Hn]#  
'--------定义部份------------------ wEkW=  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr zF{z_c#3@  
'自定义需要过滤的字串,用 "■"分离 `q5*VqIhs  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" 9JU lu  
'---------------------------------- QTLOP~^  
%> ?VzST }  
>G-D& A+  
<% 7M$>'PfO  
Str_Inf = split(Str_In,"■") ?EpY4k8,  
'--------POST部份------------------ `[:f;2(@  
If Request.Form<>"" Then ;XTP^W!6f  
For Each Str_Post In Request.Form 2^:5aABQ  
J7l1-  
For Str_Xh=0 To Ubound(Str_Inf) /Wj9Stj5  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then $Z;0/\r%  
'--------写入数据库----------头----- sXfx[)T<  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"
Y)a 7osML  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") R_Hdi~ k  
Str_db.open Str_dbstr Z+vLEEX*uQ  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") s\ ~r 8  
Str_db.close e8gD(T  
Set Str_db = Nothing #cmj?y()  
'--------写入数据库----------尾----- /sYD+*a  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" xUeLX`73  
Response.Write "非法操作！系统做了如下记录:<br>" U|y+k`  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" k@wxN!w;  
Response.Write "操作时间："&Now&"<br>" F5*Xx g}N  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ~5JXY5*o  
Response.Write "提交方式：POST<br>" YL{LdM-xM  
Response.Write "提交参数："&Str_Post&"<br>" R"82=">v  
Response.Write "提交数据："&Request.Form(Str_Post) w-\ GrxlbX  
Response.End {WC{T2:8  
End If |9
(uiWf  
Next A46y?"]/30  
VvPTL8Z  
Next 2} T"|56
 
End If
dwmj *
+  
'---------------------------------- Uq[
NOJC  
N}^\$
sVu_  
'--------GET部份------------------- $MP'j9-S?  
If Request.QueryString<>"" Then nNL9B~d  
For Each Str_Get In Request.QueryString zx\?cF  
.IG(Y!cB  
For Str_Xh=0 To Ubound(Str_Inf) 1YS{; y[o  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then Q*lZ;~R  
'--------写入数据库----------头----- l9SbuT$U  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" -ff*,b$Q/  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") M/#<=XhA  
Str_db.open Str_dbstr 9cj:'KG)!  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") 9 s>JdAw?  
Str_db.close ?p}m[9@  
Set Str_db = Nothing W/&cnp\  
'--------写入数据库----------尾----- 0mCrA|A.  
hsVWD,w  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" BGUP-_&  
Response.Write "非法操作！系统做了如下记录:<br>" ]^.#d   
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" T$RZRZo  
Response.Write "操作时间："&Now&"<br>" <)"Mi}Q[)p  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" paiF ah  
Response.Write "提交方式：GET<br>" N]5-#  
Response.Write "提交参数："&Str_Get&"<br>" 5$jKw\FF=  
Response.Write "提交数据："&Request.QueryString(Str_Get) XRaq\a`=:  
Response.End Z!ub`coV[  
End If QR a>W/N  
Next cl{;%4$9  
Next @y}1%{,%  
End If q5QYp  
%> e&wWlB![  
第3中方法需要你自己建个数据库表