防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ Tk`|{Ph0  
%J1oz3n  
试试这两种方法: P>03 DkbB  
第一种： 
?},RN  
squery=lcase(Request.ServerVariables("QUERY_STRING")) vF/wV'Kk  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) JU)k+:\a  
/w2-Pgm-[\  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" U*go}dt"5  
vUDMl Z  
SQL_inj = split(SQL_Injdata,"|") u1\r:q  
jX^_(Kg  
For SQL_Data=0 To Ubound(SQL_inj) 5Yww,s  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then D'BGoVP  
Response.Write "SQL通用防注入系统" QV4F A&f&  
Response.end D_`NCnYG  
end if J"TF@7{p  
next
{i}E)Np  
Sl@Ucc31  
t6lwKK  
`;j$]  
第二种： zJ@^Bw;A^@  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" q1m{G1W n  
cmU>A721  
SQL_inj = split(SQL_Injdata,"|") : LT'#Q8  
QZ*gR#K]Sz  
If Request.QueryString<>"" Then 77ztDQDtM  
For Each SQL_Get In Request.QueryString tf[)| /M  
For SQL_Data=0 To Ubound(SQL_inj) tg\o"QKW9  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then -=ZDfM  
Response.Write "SQL通用防注入系统" F07X9s44E  
Response.end ru
4M=D  
end if _KkP{g,Y  
next 
H6U5-  
Next ~@#a*="  
End If {-%8RSK=<  
9Hd_sNUu\  
If Request.Form<>"" Then :\y' ?d- Q  
For Each Sql_Post In Request.Form <Y$( lszT  
For SQL_Data=0 To Ubound(SQL_inj) ydAiH*>  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then syI|gANT/r  
Response.Write "SQL通用防注入系统" J;4aghzY  
Response.end q%dbx:y#  
end if 1I)oT-~  
next C2\zbC[qm  
next <1 ;pyw y  
end if NB+/S;`  
;~'&m  
第三种 dlIYzO<  
<% v TTXeS-b  
'--------定义部份------------------ 7!\zo mx  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr Rz[3cN)?q  
'自定义需要过滤的字串,用 "■"分离 FYK`.>L28  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" e6^}XRyf  
'---------------------------------- IDL0!cF  
%> Iga#,k+%  
0N$FIw2  
<%  G8!|Lo  
Str_Inf = split(Str_In,"■") HxcL3Bh$~}  
'--------POST部份------------------ TQ5kM  
If Request.Form<>"" Then ?Dn}  
For Each Str_Post In Request.Form =G"ney2  
+'nMy"j1  
For Str_Xh=0 To Ubound(Str_Inf) dC|6z/  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 0m"Ni:KEf  
'--------写入数据库----------头----- -Tn%O|#K  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};"  WjCxTBI  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ga(k2Q;y  
Str_db.open Str_dbstr NFKvgd@  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") z,4 D'F&  
Str_db.close /bPs0>5  
Set Str_db = Nothing q6<P\CSHy<  
'--------写入数据库----------尾----- Ps{v N ~}  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" }}D32TVN  
Response.Write "非法操作！系统做了如下记录:<br>" ={+8jQqi1  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" o{^`Y   
Response.Write "操作时间："&Now&"<br>" kX8NRP
W  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" +.OdrvN4)  
Response.Write "提交方式：POST<br>" F\|4zM  
Response.Write "提交参数："&Str_Post&"<br>" ]}p<P):hO  
Response.Write "提交数据："&Request.Form(Str_Post) d325Cw?  
Response.End 't5`Ni  
End If <HzL%DX  
Next _l"nwE
s  
'4Fwh]Ee  
Next T[#q0bv  
End If i'4.w?OZ  
'---------------------------------- ]vP}K   
>?r
MMR+A  
'--------GET部份-------------------  xu%eg]  
If Request.QueryString<>"" Then >[;=c0(  
For Each Str_Get In Request.QueryString Vu=/<;-N  
u05Yy&(f  
For Str_Xh=0 To Ubound(Str_Inf) n.z,-H17  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then '+27_j  
'--------写入数据库----------头----- c&F Ot  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" !a-B=pn!]  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") Bv'%$}}-  
Str_db.open Str_dbstr aT( _c/t.  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") wy0?*)~  
Str_db.close xwi6
#>  
Set Str_db = Nothing yMTO5~U{  
'--------写入数据库----------尾----- X6 N&:<  
YRFz]  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" 14jN0\  
Response.Write "非法操作！系统做了如下记录:<br>" }a.j~>rq  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>"  bLAHVi<.  
Response.Write "操作时间："&Now&"<br>" 9 <{C9  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" )%3T1 D/  
Response.Write "提交方式：GET<br>" %OHZOs  
Response.Write "提交参数："&Str_Get&"<br>" ,v,rY'  
Response.Write "提交数据："&Request.QueryString(Str_Get) N5h9){Mx  
Response.End XM
,slQ  
End If :O$bsw:3w<  
Next RHMXPsj  
Next 3?@6QcHl{  
End If XmwAYf  
%> RAP-vVh/C  
第3中方法需要你自己建个数据库表