防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ |)?aH2IL  
ikY]8BCc  
试试这两种方法: rO(TG  
第一种： Z;fm;X%4  
squery=lcase(Request.ServerVariables("QUERY_STRING")) yC'hwoQ`  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) Rnj Jg?I=  
Sj0 ucnuHi  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" <E[HlL  
A3MZxu=':3  
SQL_inj = split(SQL_Injdata,"|") f3zfRhkIk  
O2q=gYX>\  
For SQL_Data=0 To Ubound(SQL_inj) GS
GyF  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then <84C tv  
Response.Write "SQL通用防注入系统" } $Hs;4|  
Response.end GX7 eRqz>  
end if c?.r"5#  
next xTJSr2f  
(: ?5 i`  
U0h)pdo  
H~?*KcZ 0\  
第二种： #QTfT&m+G}  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" rL%]S&M9  
<78$]Z2we  
SQL_inj = split(SQL_Injdata,"|") j<ABO")v  
mq J0z4I}  
If Request.QueryString<>"" Then U]
V3DDN  
For Each SQL_Get In Request.QueryString O t *K+^I  
For SQL_Data=0 To Ubound(SQL_inj) C#U<k0R  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then NK7H,V}T  
Response.Write "SQL通用防注入系统" Uz6{>OCvk|  
Response.end p}YI#f in/  
end if j-lSFTo  
next V3>f*Z)xn  
Next xvwD3.1  
End If S'Z70 zJ  
gp~yt0A
U  
If Request.Form<>"" Then a=J@yK  
For Each Sql_Post In Request.Form ;x:k-s2-  
For SQL_Data=0 To Ubound(SQL_inj) +cz"`T`X 2  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then cWN d<=Jp  
Response.Write "SQL通用防注入系统" '}jf#C1$c  
Response.end k^H0b\hYY  
end if 2BoFyL*  
next bz,Da  
next Js\-['`  
end if 9J~:m$.  
K1?Z5X(b  
第三种 Ur'9bl{5  
<% 2d-TU_JqX  
'--------定义部份------------------ + ,@ FxZl  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr &`9j)3^J.  
'自定义需要过滤的字串,用 "■"分离 L;/9L[s,  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" yGba  
'---------------------------------- $|4cJ#;^L  
%> <8u>_
o6  
UWQtvQ f  
<% B#FHf Z  
Str_Inf = split(Str_In,"■") _1I K$gb[  
'--------POST部份------------------ oN *SRaAp  
If Request.Form<>"" Then 9{_8cpm4  
For Each Str_Post In Request.Form oR*ztM  
_*O7l  
For Str_Xh=0 To Ubound(Str_Inf) 
'e}uvbK  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then H_VEPp,T  
'--------写入数据库----------头----- }x*7l`1  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" u?Fnlne4@  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") R=!kbBK>\  
Str_db.open Str_dbstr LtC~)R  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") FX H0PK  
Str_db.close aXMv(e+  
Set Str_db = Nothing K@B" ]6  
'--------写入数据库----------尾----- 1TKEm9j]u  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" ^'m\D;
 
Response.Write "非法操作！系统做了如下记录:<br>" u3
U4U K  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" \ I?w)CE@R  
Response.Write "操作时间："&Now&"<br>" 59V#FW
e-  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" O/mR9[}  
Response.Write "提交方式：POST<br>" ]JH64~a  
Response.Write "提交参数："&Str_Post&"<br>" "[k1D_PZ  
Response.Write "提交数据："&Request.Form(Str_Post) 538fK9[  
Response.End *D2Nm9sl  
End If WrNLGkt  
Next X4a^mw\"  
M|d={o9Hp  
Next t{!/#eQC  
End If fV 3r|Bp  
'---------------------------------- Rq) 0i}F  
WP}ixcq#  
'--------GET部份------------------- LIF|bE9kd  
If Request.QueryString<>"" Then "u_i[[y  
For Each Str_Get In Request.QueryString tv0Ha A  
R,%_deV\(  
For Str_Xh=0 To Ubound(Str_Inf) WE0}$P:  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then t#Th9G]1  
'--------写入数据库----------头----- kBo;h.[l  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" F KC\V F  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") W;4Lkk$  
Str_db.open Str_dbstr 3QW_k5o  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") ylu2R0] (  
Str_db.close +IrZ ;&oy  
Set Str_db = Nothing w!\3ICB  
'--------写入数据库----------尾----- Y(_KizBY  
$_sYfU9  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" -IadHX}]t  
Response.Write "非法操作！系统做了如下记录:<br>" $xT1 1 ^  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" L7]]ZAH!1  
Response.Write "操作时间："&Now&"<br>" +Gow5-(  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ,of]J|  
Response.Write "提交方式：GET<br>" 61} i5o  
Response.Write "提交参数："&Str_Get&"<br>" /prYSRn8  
Response.Write "提交数据："&Request.QueryString(Str_Get)
C
ZJV_0  
Response.End _-O cc=Z
 
End If &iqw! ud  
Next ;$7v%Ls=  
Next `N}d}O8   
End If :=*}htP4C  
%> |f\D>Y%)  
第3中方法需要你自己建个数据库表