防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ 6]5e(J{Fz  
L<M
H:  
试试这两种方法: 5Uha,Q9SA  
第一种： 1wM~),B8  
squery=lcase(Request.ServerVariables("QUERY_STRING")) I`FqZw  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) 7xy[;  
jxNnrIA  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" I<^&~==  
=^S1+B MY-  
SQL_inj = split(SQL_Injdata,"|") 1|/]bffg!c  
z~O:w'(g  
For SQL_Data=0 To Ubound(SQL_inj) Ij9ezNZT=  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then `78)|a*R.  
Response.Write "SQL通用防注入系统" Y>2kOE  
Response.end ^OnZ9?C{R  
end if YVS~|4hu?i  
next %Y*]eLT>  
"$rmy>d  
JUlCj#%  
t*{B
N>B  
第二种： LyA}Nd]pyq  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" U *']7-  
Bi$nYV)-l  
SQL_inj = split(SQL_Injdata,"|") aX{i   
pLea 4  
If Request.QueryString<>"" Then y?@(%PTp  
For Each SQL_Get In Request.QueryString 1/%g VB8  
For SQL_Data=0 To Ubound(SQL_inj) -"MB(`  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then LyWgaf#/d  
Response.Write "SQL通用防注入系统" TuX9:Q  
Response.end )$7-C NWr~  
end if Fl0 :Z  
next !,zRg5Wp4  
Next '\I!RAZ  
End If EQ>]~  
U>=& 2Z2?  
If Request.Form<>"" Then
@<,YUp,%S  
For Each Sql_Post In Request.Form X|Z2"*;b`  
For SQL_Data=0 To Ubound(SQL_inj) UUaC@Rs2  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then r\DA
&b  
Response.Write "SQL通用防注入系统" >* >}d%  
Response.end )=@SA`J  
end if
yV/A%y-P  
next 3}9c0%}F  
next u[G`_Y{=EM  
end if 1xzOD@=dI  
z}&JapJ  
第三种 sbV {RS l  
<% KR sY `[Y  
'--------定义部份------------------ o+I'nFtnI  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 5svM3  #  
'自定义需要过滤的字串,用 "■"分离 t2 0Es  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" \:@yfI@  
'---------------------------------- CFyu9Al  
%> T?Y/0znB*  
3C7}
V{?  
<% b!3Y<D*  
Str_Inf = split(Str_In,"■") $Y9Wzv3Ra  
'--------POST部份------------------ +JrbC/&  
If Request.Form<>"" Then HHcWyu  
For Each Str_Post In Request.Form 1NQstmd{  
tEE4"OAy  
For Str_Xh=0 To Ubound(Str_Inf) .*W_;Fo  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then -J\R}9 lIm  
'--------写入数据库----------头----- O[O[E}8#  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" N497"H</  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") /<-@8CC<  
Str_db.open Str_dbstr ;'~GuZ#I  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") 99tKs  
Str_db.close .T|1l$Jn  
Set Str_db = Nothing \1R<GBC4  
'--------写入数据库----------尾----- LOf)D7T  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" ]p5]n*0X  
Response.Write "非法操作！系统做了如下记录:<br>" bIP%xl Vp  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" t0-)\kXcA  
Response.Write "操作时间："&Now&"<br>" %kSpMj|  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 0` \!O(jJ  
Response.Write "提交方式：POST<br>" GB\
1'  
Response.Write "提交参数："&Str_Post&"<br>" 6< O|,7=_  
Response.Write "提交数据："&Request.Form(Str_Post) k1HVvMD<  
Response.End ,J)wn;@  
End If {]V+C=`  
Next ]mSkjKw  
h<I C d'!  
Next PG*:3![2  
End If ~![J~CkPS  
'---------------------------------- cH>3|B*y  
(+lCh7.  
'--------GET部份------------------- "ukiuCfVuW  
If Request.QueryString<>"" Then %MH!L2|  
For Each Str_Get In Request.QueryString + o[-ED  
K! I]0!:  
For Str_Xh=0 To Ubound(Str_Inf) &x>8 %Q s  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then CP"   
'--------写入数据库----------头----- {RPZq2Tpc  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 7ts`uI<E@7  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") Cr#Z.  
Str_db.open Str_dbstr q@0g KC&U  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") ! uX0G4  
Str_db.close R-lpsvDDL2  
Set Str_db = Nothing |];f?1  
'--------写入数据库----------尾----- *p Q'w  
5,Hj$v7fe  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" 4<(U/58a*  
Response.Write "非法操作！系统做了如下记录:<br>" .&2Nm&y$K  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 9w:9XziT  
Response.Write "操作时间："&Now&"<br>" %=EN 3>,  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" LCouDk(=`  
Response.Write "提交方式：GET<br>" x}B_;&>&"_  
Response.Write "提交参数："&Str_Get&"<br>" VS ?npH  
Response.Write "提交数据："&Request.QueryString(Str_Get)
lz>>{  
Response.End (dgBI}Za  
End If Tw+V$:$$  
Next F\IJim-Rh  
Next K 0Gm ?(  
End If `<x(( @#  
%> "B3&v%b  
第3中方法需要你自己建个数据库表