防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ JXL'\De ;  
f0OgK<.>T  
试试这两种方法: :fhB*SYK  
第一种： HXyFj  
squery=lcase(Request.ServerVariables("QUERY_STRING")) a`s/qi  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) J, r Xx:  
Um\0i;7 ~4  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 8YKQItK  
;cLUnsB\  
SQL_inj = split(SQL_Injdata,"|") Wcn[gn<  
OXCQfT@\  
For SQL_Data=0 To Ubound(SQL_inj) "xn
|zB  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then cix36MR_  
Response.Write "SQL通用防注入系统" Pin/qp&Fa8  
Response.end 'hF@><sqk  
end if ]u0Jd#@  
next :XYy7xz<  
cgN>3cE  
4.'JLArw  
s:b"\7  
第二种： W&KM/9d  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" [e1L{_*l  
 Uouq>N  
SQL_inj = split(SQL_Injdata,"|") (bvoF5%  
-TS? fne)  
If Request.QueryString<>"" Then ESv:1o`?n  
For Each SQL_Get In Request.QueryString 5(#-)rlGj  
For SQL_Data=0 To Ubound(SQL_inj) SK-W%t  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then 0D~=SekQ9  
Response.Write "SQL通用防注入系统"  D%gGRA  
Response.end 1a8$f5  
end if Q6x%  
next 11{y}J  
Next ,E9d
\+j  
End If L=g_@b  
t!~S9c  
If Request.Form<>"" Then W+hV9  
For Each Sql_Post In Request.Form L {qJ-ln:  
For SQL_Data=0 To Ubound(SQL_inj) ; RHNRVP  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then k!owl+a   
Response.Write "SQL通用防注入系统" !DcX 8~~@  
Response.end c3W BALdh  
end if Gkmsaf>  
next U0IE1_R  
next Q1T@oxV  
end if !=[>r'+3  
}dKLMNqPA  
第三种 7=3O^=Q^Q  
<% M BVOfEMj  
'--------定义部份------------------ wDw<KU1UK  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr qd8pF!u|#  
'自定义需要过滤的字串,用 "■"分离 `< Yf{'*  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" */_@a?  
'---------------------------------- TY6 rwU  
%> {i;6vRr  
9^\hmpP@D  
<% 8[R1A  
Str_Inf = split(Str_In,"■") K(OaW)j
 
'--------POST部份------------------ mp:m`sh*i  
If Request.Form<>"" Then '\t7jQ
 
For Each Str_Post In Request.Form Xm@aYNV  
0H+c4IW  
For Str_Xh=0 To Ubound(Str_Inf) 75AslL?t  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then DY.58IHg1  
'--------写入数据库----------头----- SH=:p^J  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" LS6ry,D"7  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") JJ-i_5\q  
Str_db.open Str_dbstr pBU]=[M0  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") iaRR5
D-  
Str_db.close <+q$XL0  
Set Str_db = Nothing L[]BzsIv  
'--------写入数据库----------尾----- "@)lH  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" VYigxhP7  
Response.Write "非法操作！系统做了如下记录:<br>" y\z > /q  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" hVf^  
Response.Write "操作时间："&Now&"<br>" q~h:<,5  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" mPG7Zy$z  
Response.Write "提交方式：POST<br>" 8Zw]f-5x\  
Response.Write "提交参数："&Str_Post&"<br>" 8K^f:)Qw  
Response.Write "提交数据："&Request.Form(Str_Post) -)RJ\V^{9  
Response.End wT/6aJoX  
End If j)";:v  
Next (Oq
Hfv  
a.,i .2  
Next ^1VbH3M  
End If M2p<u-6 "  
'---------------------------------- (Fqa][0  
<\ETPL,<  
'--------GET部份------------------- &I)\*Ue2t  
If Request.QueryString<>"" Then [+Un ^gD  
For Each Str_Get In Request.QueryString b{pg!/N4  
r0Z+RB^I  
For Str_Xh=0 To Ubound(Str_Inf) O9e.
=l  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 2fbU-9Rfn  
'--------写入数据库----------头----- u`6/I#q`  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"  v$3_o :  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") liD47}+  
Str_db.open Str_dbstr +*D4(  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") |D<+X^0'  
Str_db.close MD4\QNUa)*  
Set Str_db = Nothing ! TDD^  
'--------写入数据库----------尾----- [#Fg\2bq_y  
,LZ(^u  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" n$W"=Z;`  
Response.Write "非法操作！系统做了如下记录:<br>" 4>k I^  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" N
jP ]My  
Response.Write "操作时间："&Now&"<br>" 74]a/'
4  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ?4sJw:  
Response.Write "提交方式：GET<br>" BKZ v9  
Response.Write "提交参数："&Str_Get&"<br>" qiU5{}  
Response.Write "提交数据："&Request.QueryString(Str_Get) _<3r'Y,  
Response.End @'Q%Jc(  
End If j<@fT ewZ  
Next ^F&A6{9f/h  
Next Op90 NZI#K  
End If ;&q]X]bJ  
%> v?}pi  
第3中方法需要你自己建个数据库表