防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ Y ue#  
BW5!@D2  
试试这两种方法: ~Bls
j9a2  
第一种： F&)(G\  
squery=lcase(Request.ServerVariables("QUERY_STRING")) "Cn<x\E b  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) hNUka
P  
m5kt O^EU  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" Bnu5\P  
@3W
I7q4  
SQL_inj = split(SQL_Injdata,"|") nmy!.0SQ-  
aC,?FWm  
For SQL_Data=0 To Ubound(SQL_inj) _d*QA{  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then !Jk|ha~r  
Response.Write "SQL通用防注入系统" V:>ZSW4,^  
Response.end v7#`b}'W  
end if K<~J*k<v  
next N*6lyF cg  
WP ~]pduT  
2/f!{lz](  
?7cT$/4  
第二种： DUlvlQW  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" .NRSBk  
[e?vqm .  
SQL_inj = split(SQL_Injdata,"|") [`_-;/Gx2  
NKRI|'Y,  
If Request.QueryString<>"" Then rpMjDjW  
For Each SQL_Get In Request.QueryString 2y#[uSqB  
For SQL_Data=0 To Ubound(SQL_inj) dW} m44X  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then *^s^{0Ad  
Response.Write "SQL通用防注入系统" rw%1>]os  
Response.end Q/y"W,H#  
end if Nny#}k Bt  
next %?i~`0-:n%  
Next {-.ZFUZmT  
End If Q'R*a(pm  
oQ/ Dg+Xp  
If Request.Form<>"" Then ~ "stI   
For Each Sql_Post In Request.Form S0jYk(  
For SQL_Data=0 To Ubound(SQL_inj) p8|u0/;k  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then &p83X  
Response.Write "SQL通用防注入系统" [;,Xp/  
Response.end Y9ipy_@_?  
end if A#x_>fV  
next CoTe$C7  
next bd[%=5  
end if ~X<Ie9m1x  
rlP?Uh  
第三种  ie4BE'  
<% L/7YI\C2  
'--------定义部份------------------ I6.}r2?;A  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr :7 OhplI  
'自定义需要过滤的字串,用 "■"分离 'l&bg8K9  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" qJ%AbdOI8  
'---------------------------------- 4#Id0['  
%> u3])_oj=  
#@8JYzMq%  
<% SioP`*,}  
Str_Inf = split(Str_In,"■") @; 0t+  
'--------POST部份------------------ +A%"_7L}  
If Request.Form<>"" Then u raT$Q}  
For Each Str_Post In Request.Form p?e-`xs  
:~4M9  
For Str_Xh=0 To Ubound(Str_Inf) R,f"2 k  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then *di}rQHm  
'--------写入数据库----------头----- =,
G^GMi'  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" fUa[3)I  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") |]+PDc%  
Str_db.open Str_dbstr %Qy9X+N:  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") CCp&+LRvR  
Str_db.close o~tL;(sz  
Set Str_db = Nothing Z?j4WJy-[  
'--------写入数据库----------尾----- Z;[f,Oj  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" wgFAPZr  
Response.Write "非法操作！系统做了如下记录:<br>" Ew>lk9La(  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" KreF\M%Ke  
Response.Write "操作时间："&Now&"<br>" G*'1[Bu  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" m$WN"kV`,9  
Response.Write "提交方式：POST<br>" K3-Cuku  
Response.Write "提交参数："&Str_Post&"<br>" fYUbr"Oe  
Response.Write "提交数据："&Request.Form(Str_Post) {/}p "(
^  
Response.End .u\xA 7X  
End If CaqqH`/E4  
Next u7}C):@H  
i[40p!~  
Next /@feY?glc  
End If 94b* !Z  
'---------------------------------- ' i<}/l  
K</="3 HK  
'--------GET部份------------------- _t.Ub:  
If Request.QueryString<>"" Then P?$Iht.^
 
For Each Str_Get In Request.QueryString d[$YTw  
O#3PUuE%d  
For Str_Xh=0 To Ubound(Str_Inf) 'RzzLk|$  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then Ot
([5/K  
'--------写入数据库----------头----- $i;_yTht  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" x A"V!8C  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") )Oix$B!-  
Str_db.open Str_dbstr D 9;s%  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") E)]RQ~jY?  
Str_db.close >@uFye$  
Set Str_db = Nothing 87q~ nk  
'--------写入数据库----------尾----- ew 4pAav  
q:-1ul  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" m 7/b.B}  
Response.Write "非法操作！系统做了如下记录:<br>" ^;mnP=`l[  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ]B=2r^fn  
Response.Write "操作时间："&Now&"<br>" WYY&MHp  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" f3"sKL4|  
Response.Write "提交方式：GET<br>" p}d+L{"V  
Response.Write "提交参数："&Str_Get&"<br>" ? H7?>ZE  
Response.Write "提交数据："&Request.QueryString(Str_Get) uG{/yJeU  
Response.End WNWtQ2]  
End If Mv7=ZAm  
Next |nT+W|0U  
Next 0p[-M`D  
End If BZ}_  
%> yYn7y1B  
第3中方法需要你自己建个数据库表