防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ %s$_KG!&  
O8SX#,3^}  
试试这两种方法: ;1S{xd*^N  
第一种： 8"wA8l.  
squery=lcase(Request.ServerVariables("QUERY_STRING")) SZg+5MD;X  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) Q !5Tw  
Gcg`Knr  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" tnqW!F~  
_jH1Mcq  
SQL_inj = split(SQL_Injdata,"|") ERL(>)  
0LoA-c<Ay  
For SQL_Data=0 To Ubound(SQL_inj) >IfJ.g"  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then C JiMg'K  
Response.Write "SQL通用防注入系统" gv `jeN  
Response.end v|_?qBs"  
end if d|on y
 
next #:T5_9p  
L3Ry#uw  
v0X5`VV  
[#j|TBMHM  
第二种： 5yp~PhHf  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" b9EJLD  
aO "JT  
SQL_inj = split(SQL_Injdata,"|") ,qiS;2 (  
0'^? m$  
If Request.QueryString<>"" Then gtJ^8khME  
For Each SQL_Get In Request.QueryString +x G]
(?  
For SQL_Data=0 To Ubound(SQL_inj) 5gF}7D@  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then )
U<4ul  
Response.Write "SQL通用防注入系统" {ZbeF#*"  
Response.end ZT8. r0  
end if h1fJ`WT6,  
next )[9L|o5D  
Next 'Twi @I  
End If `]5XY8^kI  
1}S_CR4XBs  
If Request.Form<>"" Then |Y(].G,  
For Each Sql_Post In Request.Form po=*%Zs*T  
For SQL_Data=0 To Ubound(SQL_inj) t
l;?/  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then )t&|oQ3sVG  
Response.Write "SQL通用防注入系统" K!|=)G3.`  
Response.end TuIeaH%x  
end if 3I:DL#f  
next b_V)]>v+  
next Q C~~  
end if !SJmu}OB]  
'P@
a_*I  
第三种 7bsW7;C  
<% -#<,i'  
'--------定义部份------------------ XIBw&mWf  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr sf\;|`}  
'自定义需要过滤的字串,用 "■"分离 \Zoo9Wy  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" A6iy JFmD  
'---------------------------------- dd nWr"_  
%> V$q%=Sip  
Km+29  
<% < py~(q  
Str_Inf = split(Str_In,"■") NWCnt,FlY  
'--------POST部份------------------ 5`x9+XvoN  
If Request.Form<>"" Then "T}J| 28Z  
For Each Str_Post In Request.Form e-qr d  
XF^c(*5  
For Str_Xh=0 To Ubound(Str_Inf) C+5^[V  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then dmlh;Z  
'--------写入数据库----------头----- Syp|s3u;  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" "j$}'uK<  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") "%f>/k;!h.  
Str_db.open Str_dbstr 42z9N\ f  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") U45/%?kE)  
Str_db.close /unOZVr(
 
Set Str_db = Nothing
;i:Uoyi  
'--------写入数据库----------尾----- y H+CyL\  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" _nx|ZJ  
Response.Write "非法操作！系统做了如下记录:<br>" d/t'N-m  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" /f%u_ 8pV%  
Response.Write "操作时间："&Now&"<br>" DVTzN(gO*~  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" "45BOw&72G  
Response.Write "提交方式：POST<br>" D>G&aQ  
Response.Write "提交参数："&Str_Post&"<br>" d_5h6Cz4  
Response.Write "提交数据："&Request.Form(Str_Post) i;|%hDNWA  
Response.End 3M1(an\nW  
End If sE/9~L  
Next '2# 0UdG  
&`>*3m(  
Next #Q'i/|g
 
End If {B\.8)&8  
'---------------------------------- uT-WQ/id  
2"__jp:(  
'--------GET部份------------------- y]?$zbB  
If Request.QueryString<>"" Then pQVi&(M  
For Each Str_Get In Request.QueryString 9s*Lzi[}  
J8b]*2 D  
For Str_Xh=0 To Ubound(Str_Inf) oAvJ"JH@i  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then \re.KB#R  
'--------写入数据库----------头----- X/7: *  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 6_XX[.%  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") |0qk  
Str_db.open Str_dbstr }FM<uB KW  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") {'!D2y.7g  
Str_db.close `M7){  
Set Str_db = Nothing Ab_aB+g ]  
'--------写入数据库----------尾----- w-\fCp )  
;quGy3  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ] KuK\(\  
Response.Write "非法操作！系统做了如下记录:<br>" l}O`cC
 
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" x<ENN>mW1  
Response.Write "操作时间："&Now&"<br>" U_VD* F4Bv  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" [MiD%FfcNH  
Response.Write "提交方式：GET<br>" .}Z
mqz[  
Response.Write "提交参数："&Str_Get&"<br>" "{V,(w8Dt  
Response.Write "提交数据："&Request.QueryString(Str_Get) Ok:@F/ v  
Response.End %mcuYR'D}  
End If ;m
`I}h<  
Next 2>EIDRLJ-  
Next *JpEBtTv=5  
End If  AOWI`  
%> erqm=)  
第3中方法需要你自己建个数据库表