防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ nYA@t=t0  
Dm^Bk?#(  
试试这两种方法: R\MFh!6sn  
第一种： ')82a49eA  
squery=lcase(Request.ServerVariables("QUERY_STRING")) 2l.qINyz  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) tXg>R _\C  
2t3DQ   
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" vdFP ^06  
6%\&m|S  
SQL_inj = split(SQL_Injdata,"|") |qq7vx  
\-nbV#{  
For SQL_Data=0 To Ubound(SQL_inj) J;#7dRW{  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then %h^ f?.(:  
Response.Write "SQL通用防注入系统" Kd|@  
Response.end T:|PSJc0  
end if o'*7I|7a  
next ]N4?*S*jd)  
=hq+9 R8=  
XnNU-UCX  
?rSm6V  
第二种： 9J(jbJ7p  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" *,y
.%`o  
D6NgdE7b  
SQL_inj = split(SQL_Injdata,"|") i!7|YAu  
{IG5qi?/E)  
If Request.QueryString<>"" Then H"vy[/UcR  
For Each SQL_Get In Request.QueryString 4RDdfY\%u  
For SQL_Data=0 To Ubound(SQL_inj) 0)HZ5^J  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then C9Xj)5k@R  
Response.Write "SQL通用防注入系统" %1UdG6&J_  
Response.end ~^ ^|]s3  
end if ZGgM-O1  
next vNIQ1x5Za  
Next c-".VF  
End If '(-SuaH49  
_I<LB0kgf.  
If Request.Form<>"" Then h3BDHz,  
For Each Sql_Post In Request.Form gu|cQ2xV  
For SQL_Data=0 To Ubound(SQL_inj) S @tpd'  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then LR:meCOI  
Response.Write "SQL通用防注入系统" <"HbX  
Response.end NA-)7i*>J  
end if '^ob3N/Y [  
next Uf`~0=w  
next < /\y<]b  
end if ;cfmMt!QWJ  
upefjwm  
第三种 fKkH [  
<% 1@6FV x  
'--------定义部份------------------ s+7#Tdh
A  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr Ns#R`WG)  
'自定义需要过滤的字串,用 "■"分离 2 r*Yd(e  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" _gn`Y(c$%  
'---------------------------------- M #)@!  
%> j3_vh<U\  
T ^1]|P  
<% i286`SLU  
Str_Inf = split(Str_In,"■") +-d)/h.7  
'--------POST部份------------------  WgayH  
If Request.Form<>"" Then & G8tb>q<V  
For Each Str_Post In Request.Form >u/ T`$  
L>>Cx`ASi  
For Str_Xh=0 To Ubound(Str_Inf) )2dTgvy  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then Y-y<gW  
'--------写入数据库----------头----- N[j*Q 8X_  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" `44 }kkBT  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") WJs2d73Qp  
Str_db.open Str_dbstr _I A{I  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") G Z~W#*|V  
Str_db.close %DIZgPd\  
Set Str_db = Nothing }N` m7PSf  
'--------写入数据库----------尾----- ITr@;@}c]  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" pdEUDuX  
Response.Write "非法操作！系统做了如下记录:<br>"  Y!*F-v@  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" M.h8Kr!.  
Response.Write "操作时间："&Now&"<br>" m)oGeD( !  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" G~FAChI8![  
Response.Write "提交方式：POST<br>" T$vDw|KSVP  
Response.Write "提交参数："&Str_Post&"<br>" qpZR-O  
Response.Write "提交数据："&Request.Form(Str_Post) xp;CYr"1}  
Response.End uYy&<_r  
End If p0bMgP  
Next 5* 3T+OK  
5rPK7Jh`B  
Next s!eB8lkcT  
End If 9%6W_0>  
'---------------------------------- m{{ 8#@g  
R8n/QCeY{  
'--------GET部份------------------- hY[Vs5v  
If Request.QueryString<>"" Then L.R4 iN  
For Each Str_Get In Request.QueryString Bq*aP*jv  
,I^:xw_  
For Str_Xh=0 To Ubound(Str_Inf) 5 4vDP9  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then uX8yS|= *  
'--------写入数据库----------头----- alz2F.%Y  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" KX
vBJA$  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") C'oNGOEd  
Str_db.open Str_dbstr BELx
aV,  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") V0)F/qY  
Str_db.close RM `zxFn  
Set Str_db = Nothing +L
>?kr[i[  
'--------写入数据库----------尾----- 4!)=!sL;  
}n[ <$*W^  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" *r|)@K|  
Response.Write "非法操作！系统做了如下记录:<br>" Qs1e0LwA9  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" = k7}[!T  
Response.Write "操作时间："&Now&"<br>" OHyB
NJ  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" MzX4/*ba  
Response.Write "提交方式：GET<br>" 3V)NM%Aw  
Response.Write "提交参数："&Str_Get&"<br>" ]^c]*O[8  
Response.Write "提交数据："&Request.QueryString(Str_Get) l?J|Ip2W  
Response.End +u| p<z  
End If {ZR>`'^:  
Next Yfjp:hg/!  
Next V+- ]txu|  
End If z(JDLd  
%> =*Ru2  
第3中方法需要你自己建个数据库表