防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ JNZ
O7s  
u^Sa{Jk=  
试试这两种方法: qe{:9  
第一种： 9yt)9f  
squery=lcase(Request.ServerVariables("QUERY_STRING")) ltH?Ew<
]  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) /3pvq%i  
/3mt=1/~{B  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" s}5,<|DL  
RAps`)OR?  
SQL_inj = split(SQL_Injdata,"|") oPCtLz}z  
$ctpg9 7  
For SQL_Data=0 To Ubound(SQL_inj) ?[z@R4at  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then 8uD%  
Response.Write "SQL通用防注入系统" -D&d1`N4  
Response.end L7rH=gZ&!]  
end if $F M:8^  
next .FWi$B';  
C>gC99  
D%%@+3a  
/ho7O/aAa  
第二种： kx.8VUoM V  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" *<"#1H/q  
"eb+
O  
SQL_inj = split(SQL_Injdata,"|") 6 #m:=  
E$1P H)  
If Request.QueryString<>"" Then La9:qpj  
For Each SQL_Get In Request.QueryString *< ?~  
For SQL_Data=0 To Ubound(SQL_inj) WLkfo 6Nw  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then N6thbH@  
Response.Write "SQL通用防注入系统" jM'(Qa   
Response.end =`W#R  
end if kmZ  U;Z  
next 7~ =r9-&G  
Next id:6O+\  
End If :)g}x&A^$  
59X'-fg,  
If Request.Form<>"" Then u`~,`z^{n  
For Each Sql_Post In Request.Form yZyB.wT  
For SQL_Data=0 To Ubound(SQL_inj) )~L qB
h  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then dZIruZ)x
 
Response.Write "SQL通用防注入系统" z\zqmW6  
Response.end ,\^RyHg  
end if e]k\dj;,^%  
next eX3|<Bf  
next %SKJ#b  
end if ^9`S`Bhp  
tYST&5Kh~  
第三种 <#%kmYSL  
<% L[aA4`  
'--------定义部份------------------ <Dq7^,}#  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr O;CC(  
'自定义需要过滤的字串,用 "■"分离 5kdh!qy[$,  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" H5X.CcI&}  
'---------------------------------- [MI
?  
%> kBr?Q  
25wvB@0&  
<% 8d|#W  
Str_Inf = split(Str_In,"■") ,he1WjL  
'--------POST部份------------------ >'g>CD!  
If Request.Form<>"" Then &w ea]./B  
For Each Str_Post In Request.Form >V|KS(}s  
7:Be.(a  
For Str_Xh=0 To Ubound(Str_Inf) h'| J$  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then \s^4f#  
'--------写入数据库----------头----- t1rAS.z&  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ?j|i|WUD  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") GEbm$ \  
Str_db.open Str_dbstr DR c-L$bD  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") )g PkL r  
Str_db.close (*Fb/  
Set Str_db = Nothing {O" N2W  
'--------写入数据库----------尾----- uz'MUT(68  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" m$!Ex}2  
Response.Write "非法操作！系统做了如下记录:<br>" =Yt)b/0b9  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" g),t  
Response.Write "操作时间："&Now&"<br>" \VAm4   
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>"  Ds@nuQ  
Response.Write "提交方式：POST<br>" sRaTRL2  
Response.Write "提交参数："&Str_Post&"<br>" .0b4"0~T6  
Response.Write "提交数据："&Request.Form(Str_Post) ]G
H_;  
Response.End </-aG[Fi  
End If ^6i,PRScS  
Next MG(qQ#;j/  
RM6*c .  
Next JthW"{E  
End If XZH\HK)K-]  
'---------------------------------- Q8?:L<
A  
,cCBAOueO  
'--------GET部份------------------- S
sfH
p  
If Request.QueryString<>"" Then W0;
MGBfb  
For Each Str_Get In Request.QueryString \@F~4,VT  
LnlDCbF;!  
For Str_Xh=0 To Ubound(Str_Inf) n1r'Y;G  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 4KnrQ-D  
'--------写入数据库----------头----- ("txj[v-/  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ,f)#&}x*2+  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") KbM1b  
Str_db.open Str_dbstr E;-*LT&{  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") 0*F<tg,+]  
Str_db.close vH)V
\V  
Set Str_db = Nothing V PaW-o  
'--------写入数据库----------尾----- +V;@)-   
=PAsyj  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" J[{?Y'RUM  
Response.Write "非法操作！系统做了如下记录:<br>" 3\E G  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 6u[ B}%l  
Response.Write "操作时间："&Now&"<br>" fZNe[|  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" F*J@OY8i  
Response.Write "提交方式：GET<br>" cZl/8?dj}  
Response.Write "提交参数："&Str_Get&"<br>" 9D,/SZ-v  
Response.Write "提交数据："&Request.QueryString(Str_Get) _,bDv`>Ra  
Response.End D5$|vv1  
End If >`o;hTS  
Next 1T/ 72+R0  
Next b 67l\L  
End If zya2 O?s  
%> WNcJ710k27  
第3中方法需要你自己建个数据库表