防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ P<vU!`x%q  
Ru* gbv,U  
试试这两种方法: /Z^a,%1  
第一种： S8/~'<out  
squery=lcase(Request.ServerVariables("QUERY_STRING")) CQ/+- -o  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) o(Z~J}l({  
]9/A=p?J@  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" P* 0kz@  
lD[@D9  
SQL_inj = split(SQL_Injdata,"|") } (-9d  
*.>@  
For SQL_Data=0 To Ubound(SQL_inj) bs)wxU`Q*  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then U-1UWq  
Response.Write "SQL通用防注入系统" ,v8e7T  
Response.end E :**gvfq  
end if 7JQ4*RM  
next p$1 'e,G  
~<VxtcEBz  
^t gjs$M|  
{*GBUv5  
第二种： 1[Yl8W%pj  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" v(.mM9>  
OH2IO  
SQL_inj = split(SQL_Injdata,"|") oydP}X  
6&SNFOX{@  
If Request.QueryString<>"" Then _p0Yhju?  
For Each SQL_Get In Request.QueryString Q2m
[XcnX  
For SQL_Data=0 To Ubound(SQL_inj) {q8|/{;  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then )?#K0o[<  
Response.Write "SQL通用防注入系统" ;u'VR}4ph  
Response.end vJ'22)n
 
end if z[_Y
,I  
next Lr*PbjQDIY  
Next <H60rON  
End If o<!H/PN  
W1"N Kg~4  
If Request.Form<>"" Then `Pj7:[."[  
For Each Sql_Post In Request.Form Fh)xm* u(  
For SQL_Data=0 To Ubound(SQL_inj) !vu -`u~86  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then i:jXh9+  
Response.Write "SQL通用防注入系统" \^ds e  
Response.end JX5/PCO  
end if 3R%JmLM+R9  
next v\?J=|S+  
next GZrN,M  
end if \X*y~)+K`  
}9 \6!GY0  
第三种 @PNgqjd  
<% )yig=nn  
'--------定义部份------------------ ?
B ,<gen  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr /FXvrH(  
'自定义需要过滤的字串,用 "■"分离 oz=ULPZ%  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" _dk[k@5W{'  
'---------------------------------- BE@(| U  
%> COHBjufmR  
A8mc+ Bf(  
<% ]m 3cm  
Str_Inf = split(Str_In,"■") Iga+8k  
'--------POST部份------------------ 7SJ=2  
If Request.Form<>"" Then WIi,`/K+  
For Each Str_Post In Request.Form VZcW 3/Y  
tb~E.Lm\  
For Str_Xh=0 To Ubound(Str_Inf) R~a9}&  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then OjlX<y.  
'--------写入数据库----------头----- M}11 tUl  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" AH'c:w]~  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") _w? !Mu  
Str_db.open Str_dbstr v^o`+~i  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") 5<PNl~0  
Str_db.close BXdk0  
Set Str_db = Nothing lJFy(^KQG,  
'--------写入数据库----------尾----- zKJQel5  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" LhAW|];  
Response.Write "非法操作！系统做了如下记录:<br>" ^\B4]'+^j  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ?C fQwY#N  
Response.Write "操作时间："&Now&"<br>" I(R%j]LX&  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" NCi~. I  
Response.Write "提交方式：POST<br>" DQW)^j h  
Response.Write "提交参数："&Str_Post&"<br>" |T"vF`Kr(>  
Response.Write "提交数据："&Request.Form(Str_Post) 9;{(. K  
Response.End d]sqj\Q57  
End If %p)&mYK{  
Next #p*uk  
F5x*#/af  
Next C=&n1/  
End If {u y^Bui}  
'---------------------------------- Rjq\$aY}%  
@ hA`f4^  
'--------GET部份------------------- 7/ hn%obC  
If Request.QueryString<>"" Then "!vY{9,  
For Each Str_Get In Request.QueryString m0^ "fMV  
[5IbR9_  
For Str_Xh=0 To Ubound(Str_Inf) 1HNP@9ga  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then qZ[H ILh!  
'--------写入数据库----------头----- &D{!zF  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" Gf#l ^yr  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") M.y!J  
Str_db.open Str_dbstr ]\|2=  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") !YGHJwW:  
Str_db.close ]3,9."^  
Set Str_db = Nothing w]qM  
'--------写入数据库----------尾----- H
EFgEYlO  
;Z0&sFm  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" T\p>wiY2|F  
Response.Write "非法操作！系统做了如下记录:<br>" |LC"1 k  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" y{3+Un  
Response.Write "操作时间："&Now&"<br>" :atd_6   
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" b1#C,UWK  
Response.Write "提交方式：GET<br>" .up[wt gN  
Response.Write "提交参数："&Str_Get&"<br>" 9jf9u0  
Response.Write "提交数据："&Request.QueryString(Str_Get) 1QA/ !2E  
Response.End xva e^gr  
End If ^cP Vnl  
Next #'KM$l,P  
Next |(Wwh$  
End If R2~y<^.V`Y  
%> 3t+{
~{Dj  
第3中方法需要你自己建个数据库表