防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ;Ss$2V'a  
QGPw
2Q  
试试这两种方法: ;#anZC;  
第一种： kDsI p=  
squery=lcase(Request.ServerVariables("QUERY_STRING")) nkY@_N
 
sURL=lcase(Request.ServerVariables("HTTP_HOST")) Kn}ub+
"J  
vzR =>0#  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" FLr;`3  
_ Jc2&(;  
SQL_inj = split(SQL_Injdata,"|") SN">g
mY+  
j4.&l3  
For SQL_Data=0 To Ubound(SQL_inj) 
2VgP  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then T~>#2 N-Z  
Response.Write "SQL通用防注入系统" 9'KonW  
Response.end >)4YP*qIPb  
end if ,E*R,'w   
next &=q! Wdw~  
Z`_.x &Y  
*i%quMv  
=!.mGW-Q}  
第二种： jj&s}_75  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" Fvl`2W94;  
5vOCCW  
SQL_inj = split(SQL_Injdata,"|") Px;Cg 6  
fC<m^%*zgA  
If Request.QueryString<>"" Then z;3NiY  
For Each SQL_Get In Request.QueryString $&{IKP)u  
For SQL_Data=0 To Ubound(SQL_inj) ]> G&jd7  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then %|IUqjg  
Response.Write "SQL通用防注入系统" X[hM8G  
Response.end H%i>L?J2/  
end if z'MS#6|}  
next :,UN8L "  
Next \U
@3`  
End If iS: #o>  
_j ;
3-m  
If Request.Form<>"" Then ~L?nq@DL  
For Each Sql_Post In Request.Form ClUSrSp  
For SQL_Data=0 To Ubound(SQL_inj) 9]yW_]P  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then B;t=B_oK  
Response.Write "SQL通用防注入系统" !{%G0(Dv  
Response.end (4+1lOd  
end if b`~wGe  
next 1mW%  
next >)#c\{c  
end if .ER98  
.5Z_E O  
第三种 AFm1t2,+;  
<% ;=;JfNnbm  
'--------定义部份------------------ 4ke^*g K<  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr
q-AN[_@  
'自定义需要过滤的字串,用 "■"分离 Ot9V< D6h  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" Sp?NfJ\Ie  
'---------------------------------- :c8^db`"  
%> m4/er539T  
*HlDS22  
<% (JZ".En#X  
Str_Inf = split(Str_In,"■") \"^%90F  
'--------POST部份------------------ ~"dhu]^  
If Request.Form<>"" Then $@uU@fLB  
For Each Str_Post In Request.Form
^R_e  
.9M
.|  
For Str_Xh=0 To Ubound(Str_Inf) ^ddO&!U  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then ZF{~ih*^u  
'--------写入数据库----------头----- 8;zDg$(  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ;u!?QSvb  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") uP|FJLY  
Str_db.open Str_dbstr C1B'#F9EO  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") `deYi2z  
Str_db.close 8T5k-HwE  
Set Str_db = Nothing '044Vm;/  
'--------写入数据库----------尾----- p@I9<^"
 
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 8LrK94  
Response.Write "非法操作！系统做了如下记录:<br>" y-+G wa3  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 2
p< Aj!  
Response.Write "操作时间："&Now&"<br>" Mg? L-C  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ($d4:Ww  
Response.Write "提交方式：POST<br>" P
Jo  
Response.Write "提交参数："&Str_Post&"<br>" l)|lTOjb  
Response.Write "提交数据："&Request.Form(Str_Post) JP=ZUu  
Response.End O|z%DkH[  
End If KH<v@IJ\  
Next ti_u!kNv  
km 5E)_]  
Next TOT PzB  
End If <r\I"z$  
'---------------------------------- .Ff_s  
+{-]P\oc  
'--------GET部份------------------- 2Rptxb_@  
If Request.QueryString<>"" Then !v>ew9  
For Each Str_Get In Request.QueryString m,6he
e  
<DmTj$  
For Str_Xh=0 To Ubound(Str_Inf) ]VjLKFb~U  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then n0fRu`SNV  
'--------写入数据库----------头----- b! tludb  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" +R\~3uj[7  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") uqZ3Hyb  
Str_db.open Str_dbstr uxDLDA$;  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") A3yi?y{[*  
Str_db.close jnBC;I[:  
Set Str_db = Nothing eyB_l
.U7  
'--------写入数据库----------尾----- i21QJ6jPcI  
!$>G#+y  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" d*- Xuv  
Response.Write "非法操作！系统做了如下记录:<br>" 0m=(W^c  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" r+ \/G{+=}  
Response.Write "操作时间："&Now&"<br>" u,9q<&,  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" WU\m^!`w=F  
Response.Write "提交方式：GET<br>" J/kH%_ >Ir  
Response.Write "提交参数："&Str_Get&"<br>" !J^tg2M8:  
Response.Write "提交数据："&Request.QueryString(Str_Get) }$aNOf%:  
Response.End kL;t8{n  
End If '
JZ_  
Next GX38~pq  
Next 8S>>7z!U  
End If p":zrf'(6  
%> Pj!%ym3A  
第3中方法需要你自己建个数据库表