防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ f.Feo  
,d~6LXr<fM  
试试这两种方法: R(dOQ. ;  
第一种： wN^$8m5\T^  
squery=lcase(Request.ServerVariables("QUERY_STRING")) wbA<G&h~  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) R\^XF8n6/  
,[{Z_co  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" N}5'Hk4
+  
f'Cx%  
SQL_inj = split(SQL_Injdata,"|") MbJ|6
g99  
zilM+BZ8  
For SQL_Data=0 To Ubound(SQL_inj) lVR a{._m  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then G.y~*5?#  
Response.Write "SQL通用防注入系统" zM+eb| >cr  
Response.end o'auCa,N  
end if $Q'S8TU  
next ,p7W4;?4  
ae-hQ
F&  
hQPNxpe  
Ks_B%d  
第二种： +204.Yj?D  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" R}J}Qb  
^mZeAW  
SQL_inj = split(SQL_Injdata,"|") _DAj$$ Ru4  
8DO3L "  
If Request.QueryString<>"" Then 9W+RUh^W  
For Each SQL_Get In Request.QueryString u>-pgu  
For SQL_Data=0 To Ubound(SQL_inj) Vb$
4'K'  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then .sE5QR Vc  
Response.Write "SQL通用防注入系统" E whCX'Vaj  
Response.end QxS=W2iN  
end if B>XfsZS  
next s6+`cC4  
Next _zF*S]9 X  
End If ObIL
w  
P{ HYZg  
If Request.Form<>"" Then X^c2  
For Each Sql_Post In Request.Form y)]L>o~  
For SQL_Data=0 To Ubound(SQL_inj) (//f"c]/  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then K]s*rPT/,  
Response.Write "SQL通用防注入系统" c3]X#Qa#m$  
Response.end j
|X>:!4r  
end if 3rh@|fg)E  
next [t}\8^y  
next 1xsIM'&  
end if d@aPhzLu  
.|Y&,?k|Y  
第三种 6L4<c+v_  
<% 8\])p sb9  
'--------定义部份------------------ p81Vt  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr A1uo@W  
'自定义需要过滤的字串,用 "■"分离 4Ow0g-{  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" d]!`II  
'---------------------------------- ?Ja&LNI9S  
%> NPY\ >pf  
'#Pg:v_  
<% SoPiEq  
Str_Inf = split(Str_In,"■") `+?g96   
'--------POST部份------------------ (m%
A>e B  
If Request.Form<>"" Then RjW< H6a"K  
For Each Str_Post In Request.Form LzE$z,  
/ij)[WK@  
For Str_Xh=0 To Ubound(Str_Inf) k/]4L!/ T  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then lU &[){  
'--------写入数据库----------头-----  SG@-b(  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ;I@@PUnR  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") |jT^[q(z  
Str_db.open Str_dbstr v"3($?au0  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") -H
-:b7  
Str_db.close #ssSs]zl  
Set Str_db = Nothing s.qo
/o\b  
'--------写入数据库----------尾----- O4lHR6M2  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" "Di8MMGOY  
Response.Write "非法操作！系统做了如下记录:<br>" bjCO@t  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" q47:kB{d  
Response.Write "操作时间："&Now&"<br>" Pua|Z x  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" _G0_<WH6  
Response.Write "提交方式：POST<br>" jPc"qER!  
Response.Write "提交参数："&Str_Post&"<br>" Al-;-t#Dc  
Response.Write "提交数据："&Request.Form(Str_Post) {$H-7-O$  
Response.End uzgQ_  
End If 9hn+eU  
Next :Y)jf
 
r)xkpa5  
Next ;FfDi*S7  
End If 5% )<e-  
'---------------------------------- BWG*UjP M  
SSo7 U  
'--------GET部份------------------- YggeKN  
If Request.QueryString<>"" Then _'Rzu'$`  
For Each Str_Get In Request.QueryString Y5,[udF:O  
ckhU@C|=*  
For Str_Xh=0 To Ubound(Str_Inf) Z(c3GmY  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then P~d&PhOe  
'--------写入数据库----------头----- ^T&@(|o  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" CaE1h9  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") +0Z,#b  
Str_db.open Str_dbstr oQ:.pq{T  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") PqDff
Z^z  
Str_db.close h}$g}f%$+  
Set Str_db = Nothing IF~E ;  
'--------写入数据库----------尾----- INjr$'*  
B/F6WQdZ  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" l\t\DX"s_  
Response.Write "非法操作！系统做了如下记录:<br>" 6>=yX6U1q^  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ewrs D'?  
Response.Write "操作时间："&Now&"<br>" rK@XC +`S  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 1r?hRJ:'  
Response.Write "提交方式：GET<br>" :XFr"aSt  
Response.Write "提交参数："&Str_Get&"<br>" ky#5G-X  
Response.Write "提交数据："&Request.QueryString(Str_Get) n> tru L  
Response.End wY'w'%A?  
End If |9'
`;4W  
Next 4-voR5Fd  
Next 1=U NA :t<  
End If egXbe)ld  
%> T0TgV  
第3中方法需要你自己建个数据库表