防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！  6f>{"'  
M}-Rzc  
试试这两种方法: r~8 $1"  
第一种： q=m'^ ,gPS  
squery=lcase(Request.ServerVariables("QUERY_STRING")) zO
IDU
  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) w\u=)3qyVV  
SrJGTuXg  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" t!X.|`h  
HTS0 s\R$  
SQL_inj = split(SQL_Injdata,"|") EhvX)s  
P[ck84F/  
For SQL_Data=0 To Ubound(SQL_inj) {.|CdqwY  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then P O^ij2eS  
Response.Write "SQL通用防注入系统" ^_W#+>&--  
Response.end ~2N"#b&J  
end if J#(LlCs?@c  
next P%VSAh\|n  
t+G# {n  
A#<?4&  
|4zIfAO  
第二种： W:nef<WH  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" v^NIx q}U  
\fdv]f  
SQL_inj = split(SQL_Injdata,"|") 2tEkj=fA-  
[Ek7b*  
If Request.QueryString<>"" Then QXFo1m  
For Each SQL_Get In Request.QueryString FUb\e-Q=  
For SQL_Data=0 To Ubound(SQL_inj) 70nqD>M4  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then  vF+7V*<  
Response.Write "SQL通用防注入系统" ,HV(l+k {|  
Response.end k FD;i  
end if e}7lBLK]*  
next ~<5!?6Yt  
Next RJ&RTo  
End If ] vsz, 0  
EGS)b  
If Request.Form<>"" Then @ioJ]$o7  
For Each Sql_Post In Request.Form (OL4Ex']  
For SQL_Data=0 To Ubound(SQL_inj) ,&.!?0+  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then ;$|nrwhy  
Response.Write "SQL通用防注入系统" PC8Q"O  
Response.end /{_:{G!Q0  
end if >tr}|>  
next IEi^kJflU  
next U7F!Z( 9  
end if C}Cs8eUn  
(?c"$|^J  
第三种 FVKTbvYn  
<% bAqA1y3=  
'--------定义部份------------------ YD6'#(  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr FW4<5~'  
'自定义需要过滤的字串,用 "■"分离 _V6ukd"B~  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" Yj49
t_$b  
'---------------------------------- *i%d,w0+  
%> ~36!?&eA8  
g3y~bf  
<% @": ^)87  
Str_Inf = split(Str_In,"■") tyFzSrfc  
'--------POST部份------------------ Q)h(nbbVak  
If Request.Form<>"" Then C1)!f j=  
For Each Str_Post In Request.Form J ZS:MFA  
! F$6-0%  
For Str_Xh=0 To Ubound(Str_Inf) gwMNYMI  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then F$]Pk|,  
'--------写入数据库----------头----- 
=:pJ  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ;A*]l'[-  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") oMa6(3T?E  
Str_db.open Str_dbstr I\ob7X'Xu!  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") 4D4j7  
Str_db.close V0mn4sfs  
Set Str_db = Nothing Ny/MJ#Lq  
'--------写入数据库----------尾----- Mi_$">1-W  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" Nh+H9  
Response.Write "非法操作！系统做了如下记录:<br>" ;O,jUiQ  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" }jPSU
do  
Response.Write "操作时间："&Now&"<br>" J{G?-+`  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" JBZ@'8eqi]  
Response.Write "提交方式：POST<br>" f$QNg0v  
Response.Write "提交参数："&Str_Post&"<br>" q) KKvO  
Response.Write "提交数据："&Request.Form(Str_Post) {'H(g[k  
Response.End GM<9p_ B  
End If y@yD5$/  
Next Ow,b^|  
aN3;`~{9  
Next hDGF
7  
End If J'r^/  
'----------------------------------
8u]2xB=K  
F!K>Kz  
'--------GET部份------------------- ^iY j[~  
If Request.QueryString<>"" Then WNc0W>*NE1  
For Each Str_Get In Request.QueryString Tlr v={  
,a? oaPH  
For Str_Xh=0 To Ubound(Str_Inf) )+Pus~w  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then x,'!gT:j  
'--------写入数据库----------头----- K*dCc}:`  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" <1!O1ab  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") GC'O[q+  
Str_db.open Str_dbstr 2 yz _  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") \_fv7Fdp{  
Str_db.close _)-o1`*-  
Set Str_db = Nothing _@/8gPT*i  
'--------写入数据库----------尾----- <~=Vg  
Flb&B1  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" dAj$1Ke  
Response.Write "非法操作！系统做了如下记录:<br>" c&Q$L }  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" _o~nr]zx  
Response.Write "操作时间："&Now&"<br>" -UT}/:a  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 3Zh)]^  
Response.Write "提交方式：GET<br>" 69 .NPy@  
Response.Write "提交参数："&Str_Get&"<br>" c:.eGH_f  
Response.Write "提交数据："&Request.QueryString(Str_Get) sDV Q#}a  
Response.End OZ;*JR:  
End If ySI!d|_  
Next 93 hxSRw  
Next zbPqYhJzA  
End If f
%hEnZv  
%> \l3h0R  
第3中方法需要你自己建个数据库表