防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ^V0{Ew/x  
X'3`Q S:!  
试试这两种方法: cQ8$,fo  
第一种： y9re17{ X  
squery=lcase(Request.ServerVariables("QUERY_STRING")) fjK]m.w  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) U d=gdsL  
P*"AtZuY]  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 8n."
5,P  
Mh-*5Rx  
SQL_inj = split(SQL_Injdata,"|") )T$fk  
,nu7r1}  
For SQL_Data=0 To Ubound(SQL_inj) 6{Cu~G{]N  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then J*q=C%}.
  
Response.Write "SQL通用防注入系统" !=q:> }g  
Response.end sgb+@&}9n  
end if {pQ@0b  
next 1X!f!0=g+  
|<+|Du1  
}TAGr 0  
T$N08aju#  
第二种： :.'T+LI  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" CrwcYzrRWl  
D=I5[t0c4  
SQL_inj = split(SQL_Injdata,"|") Z+h70,|  
:v WYII7  
If Request.QueryString<>"" Then p*W ZY=Q  
For Each SQL_Get In Request.QueryString A86lyBDQ*  
For SQL_Data=0 To Ubound(SQL_inj) uX5--o=C  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ^hYR5SX  
Response.Write "SQL通用防注入系统" lo]B5_en  
Response.end V~uA(3\U  
end if :x* |lz[  
next ;P0Y6v3  
Next L_zmU_zD  
End If pg& ]F  
'i h   
If Request.Form<>"" Then /NN[gz  
For Each Sql_Post In Request.Form lWyP[>*  
For SQL_Data=0 To Ubound(SQL_inj) /cg]wG!n8  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then WNlSve)]ie  
Response.Write "SQL通用防注入系统" r1az=$  
Response.end ~|B! .+  
end if T~ q'y~9o  
next Rp%\`'+Xz  
next /x8C70W^  
end if NE>JtTF<  
-z~ V  
第三种 HV.|Eh_7  
<% .V)2T
z  
'--------定义部份------------------ )hZ}$P1  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr >"$-VY6i  
'自定义需要过滤的字串,用 "■"分离 Z$m2rZ#  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" YI\Cs=T/  
'---------------------------------- @vYN7  
%> J-%PyvK$?  
Tdmo'"m8z_  
<% [,szx1  
Str_Inf = split(Str_In,"■") (+Nmio  
'--------POST部份------------------ Gp3t?7S{T  
If Request.Form<>"" Then 3TvhOC>yG  
For Each Str_Post In Request.Form ka9v2tE\  
x;?1#W  
For Str_Xh=0 To Ubound(Str_Inf) ^N}~U5  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then VL!kX``^F  
'--------写入数据库----------头----- '/qe#S  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ADl>~3b  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") m$y$wo<K[7  
Str_db.open Str_dbstr *,XJN_DKj  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") u b>K ^  
Str_db.close -Fw4;&>  
Set Str_db = Nothing ht cO ~b  
'--------写入数据库----------尾----- n)?F 9Wap  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" Vx4pP$S  
Response.Write "非法操作！系统做了如下记录:<br>" JjO/u>A3;7  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ZWe$(?  
Response.Write "操作时间："&Now&"<br>" WZ V*J&  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" .2S
IU4[P  
Response.Write "提交方式：POST<br>" \,IDLXqp  
Response.Write "提交参数："&Str_Post&"<br>" fdEj#Ux<H  
Response.Write "提交数据："&Request.Form(Str_Post) 4.kkxQR7r  
Response.End +so o2cb  
End If u
Y%3X/^j  
Next Y(!)G!CMc  
+
?m=f}>W1  
Next 9(
evHR7  
End If c$SxDYG  
'---------------------------------- +7vh__  
`kT$Gx4x  
'--------GET部份------------------- Kmf-l*7}  
If Request.QueryString<>"" Then d?qO`- ~$  
For Each Str_Get In Request.QueryString J<$'^AR9"q  
w.F3o4YP  
For Str_Xh=0 To Ubound(Str_Inf) m4.V$U,H]  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then XxU}|jTO#  
'--------写入数据库----------头----- &b]KMAo3  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" q\pc2Lh?^  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ;\&bvGj8V  
Str_db.open Str_dbstr x)sDf!d4bi  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") cXEy>U|/  
Str_db.close eMd1%/[  
Set Str_db = Nothing C
5

z  
'--------写入数据库----------尾----- Mn{Rg
>X  
]8cX#N,M  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" 1Y0oo jD  
Response.Write "非法操作！系统做了如下记录:<br>" ['YRY B  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 8lb `   
Response.Write "操作时间："&Now&"<br>" P >,D$-3  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 3&d +U)E  
Response.Write "提交方式：GET<br>" e5\1k#@  
Response.Write "提交参数："&Str_Get&"<br>" K
Un5S&eB  
Response.Write "提交数据："&Request.QueryString(Str_Get) X1~A "sW[  
Response.End x=r6vOj  
End If o;-!?uJ  
Next gwjv&.T6^  
Next &CsBG?@Z|  
End If K<9MK >T  
%> \Nn%*?f  
第3中方法需要你自己建个数据库表