防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ 6Vbzd0dk  
yj$TPe_BW  
试试这两种方法: ZDC9oX @  
第一种： e[Jem5C  
squery=lcase(Request.ServerVariables("QUERY_STRING")) Vm|Y$C  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) ;_(PVo  
)|I5j];L  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" JMS(9>+TA  
2]c{P\  
SQL_inj = split(SQL_Injdata,"|") k,
uK6$Z  
B=@ jWz"  
For SQL_Data=0 To Ubound(SQL_inj) 80$fG8  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then Dr~=o%  
Response.Write "SQL通用防注入系统" }=2;  
Response.end &BvZF  
end if 3J=Y9 }  
next $DP&a1'g  
.y&QqxiE  
@Kgl%[NmX  
<soz#}e  
第二种： xwH?0/  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" wCHR7X0*b  
F>X-w+b4r  
SQL_inj = split(SQL_Injdata,"|") n3`&zY  
wM_ 6{  
If Request.QueryString<>"" Then !gmH$1w  
For Each SQL_Get In Request.QueryString tWdhDt8$&  
For SQL_Data=0 To Ubound(SQL_inj) `+/H
^  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then vw)7 !/#  
Response.Write "SQL通用防注入系统" DS-fjH\  
Response.end C P3<1~  
end if uyF|O/FC  
next )kJH5/  
Next P N*JR  
End If > QFHm5Jw  
QQpP#F|w  
If Request.Form<>"" Then KA276#  
For Each Sql_Post In Request.Form *E~V
Kx1  
For SQL_Data=0 To Ubound(SQL_inj) )*5G">))p  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then 8V-\e?&^  
Response.Write "SQL通用防注入系统" /S\cU`ZVe  
Response.end :EtMH(  
end if 3<?XTv-  
next +]@Az.E  
next j2Pn<0U  
end if D5an\gE  
oQ7]=|  
第三种 0gn@h/F2%  
<% O3.C:?;x  
'--------定义部份------------------ A`u$A9[  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr '?Jxt:<  
'自定义需要过滤的字串,用 "■"分离 -[Qvg49jy  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" R4<lln:[  
'----------------------------------  YOAn4]j  
%> ;_:Ool,  
2Nj9U#A  
<% h)v^q: ='  
Str_Inf = split(Str_In,"■") Ft@Wyo`^  
'--------POST部份------------------ 4{qB X?  
If Request.Form<>"" Then Q8MS,7y/  
For Each Str_Post In Request.Form C`'W#xnp1  
S }>n1F_
 
For Str_Xh=0 To Ubound(Str_Inf) 60Z]M+8y8  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then =_[Z W  
'--------写入数据库----------头----- GyC/_ntn  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ^<0IB#dA  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 8)VgS&B~  
Str_db.open Str_dbstr ]/T-t1D  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") !?[oIQ)h  
Str_db.close @:x"]!1  
Set Str_db = Nothing M"_FrIO  
'--------写入数据库----------尾----- ,5|d3dJS  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" *g;-H&`  
Response.Write "非法操作！系统做了如下记录:<br>" 0 3~Ikll  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" fRm}S>Nibb  
Response.Write "操作时间："&Now&"<br>" :h:@o h_=  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" (H?ZSeWx  
Response.Write "提交方式：POST<br>" > 4oY3wk8  
Response.Write "提交参数："&Str_Post&"<br>" Fpt-V  
Response.Write "提交数据："&Request.Form(Str_Post) 9B+wYJp  
Response.End uvA(Rn  
End If -n*;W9  
Next zx1:`K0bi  
oY`qInM_  
Next vRPS4@9'  
End If w.N,)]h  
'---------------------------------- &gc`<kLu  
%TrF0{NR90  
'--------GET部份------------------- RH~3M0'0  
If Request.QueryString<>"" Then y5m!*=`l`  
For Each Str_Get In Request.QueryString <SVmOmJ-K  

P=H+ #  
For Str_Xh=0 To Ubound(Str_Inf) <3hA!$o~  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then T ^JuZG  
'--------写入数据库----------头----- 5A&y]5-Q`  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" Zwe[_z!*D  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 2*U.^]~"{  
Str_db.open Str_dbstr ?
G?gy2
 
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") Ih1|LR/c  
Str_db.close Ewo*yY>  
Set Str_db = Nothing #3kXmeyrD  
'--------写入数据库----------尾----- a-n4:QT  
y7<&vIEC  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>"
yoqa@V  
Response.Write "非法操作！系统做了如下记录:<br>" ^^(<c,NX#M  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" B(l-}|m_  
Response.Write "操作时间："&Now&"<br>" W>spz~w%j  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" YYRT.U'  
Response.Write "提交方式：GET<br>" !5x Ly6=}  
Response.Write "提交参数："&Str_Get&"<br>" ["3d
f>!f  
Response.Write "提交数据："&Request.QueryString(Str_Get) v&3O&y/1v  
Response.End &k T"oK  
End If ,f: jioY  
Next v6e%#=  
Next :k46S<RE  
End If tiLu75vj  
%> _ ^7|!(Sz  
第3中方法需要你自己建个数据库表