防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ qKTzigjj  
xJ9aFpTC  
试试这两种方法: @MO/LvD  
第一种： E8BIb 'b;  
squery=lcase(Request.ServerVariables("QUERY_STRING")) =YY 7V!  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) -\n%K
  
%
`*On~  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" es<8"CcP  
b8E7/~<z3  
SQL_inj = split(SQL_Injdata,"|") Ll.P>LH  
J";4+wA7  
For SQL_Data=0 To Ubound(SQL_inj) < n/ 2  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then /xj`'8  
Response.Write "SQL通用防注入系统" Xyr'rm5+b  
Response.end ["[v  
end if )]kxLf#  
next Whe-()pG{  
,B'fOJ.2  
.y<u+)  
]kd:p*U6P  
第二种： N(V_P[]"*,  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" I-#7Oq:Np  
)D ~ 5  
SQL_inj = split(SQL_Injdata,"|") R3%%;`c=  
b0Dco0U(  
If Request.QueryString<>"" Then RFo CM^  
For Each SQL_Get In Request.QueryString f-p$4%(  
For SQL_Data=0 To Ubound(SQL_inj) W4UK?#S+  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then {@6:kkd  
Response.Write "SQL通用防注入系统" Cz &3= ),G  
Response.end :
$0yp`k  
end if -V-I&sO<  
next h'?v(k!  
Next <Zvvx  
End If LI].*n/v  
`]^W#6l
 
If Request.Form<>"" Then XJ5@/BW  
For Each Sql_Post In Request.Form '6; {DX  
For SQL_Data=0 To Ubound(SQL_inj) @JGFG+J}  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then )Xa_ry7  
Response.Write "SQL通用防注入系统" 05g %5vHF  
Response.end sC0u4w>Y  
end if Vl;zd=  
next 5z =}o/?  
next u /
] P  
end if V~p01f"J  
ln+.=U6Tm  
第三种 *V4%&&{  
<% "YaT1`Kr  
'--------定义部份------------------ )K$YL='kX  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr ;dPaWS1D  
'自定义需要过滤的字串,用 "■"分离 U!NuiKaQ26  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" +(PUiiP'"v  
'---------------------------------- *ow`}Q  
%> v>j,8E  
@Pf9;7,TV  
<% {*P[dyu  
Str_Inf = split(Str_In,"■") +3J<vM}dy  
'--------POST部份------------------ }0tHzw=#%e  
If Request.Form<>"" Then 1wFW&|>1  
For Each Str_Post In Request.Form S~)`{ \  
6VVxpDAi:  
For Str_Xh=0 To Ubound(Str_Inf) n_Qua|R  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then X</Sl>[8  
'--------写入数据库----------头----- (~o"*1fk>  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" M[~{!0Uz g  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 7e\Jg/FU  
Str_db.open Str_dbstr k1oJ<$Q  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") } C:i0Q  
Str_db.close `hdff0  
Set Str_db = Nothing `+rwx  
'--------写入数据库----------尾----- 5:jme$BI  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 0KT
O)K  
Response.Write "非法操作！系统做了如下记录:<br>" @_?2iN?4Z  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" I;-Y2*  
Response.Write "操作时间："&Now&"<br>" c BZ,"kp-  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" Xdx8HB@L  
Response.Write "提交方式：POST<br>" Ar[|M2|  
Response.Write "提交参数："&Str_Post&"<br>" : NA(nA 3  
Response.Write "提交数据："&Request.Form(Str_Post) 3UaW+@  
Response.End Vjs'|%P7  
End If {kw%7}!  
Next /]^Y\U^  
^C1LQZ  
Next &a=78Z  
End If R?{xs  
'---------------------------------- kmX 9)TMVO  
:L@n(buRN  
'--------GET部份------------------- s .<.6t:G4  
If Request.QueryString<>"" Then fLqjBG] <  
For Each Str_Get In Request.QueryString T.3{}230<  
?'H d0)yZ  
For Str_Xh=0 To Ubound(Str_Inf) LWm1j:0  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then 3>^]r jFw  
'--------写入数据库----------头----- 2|=hF9  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ,h*N9}xYTi  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") r5N TTc  
Str_db.open Str_dbstr &R?`QB2/  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") V:'F_/&X?  
Str_db.close q)L4*O  
Set Str_db = Nothing qFwt^w  
'--------写入数据库----------尾----- '?| 1\j  

tT>LOI_z  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" v@tEHRadz  
Response.Write "非法操作！系统做了如下记录:<br>" nj:w1E/R  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" |Z94@uB  
Response.Write "操作时间："&Now&"<br>" `WN80d\)&  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" | bRU=dg  
Response.Write "提交方式：GET<br>" Ht4O5yl"  
Response.Write "提交参数："&Str_Get&"<br>" Yj1|]i5b  
Response.Write "提交数据："&Request.QueryString(Str_Get) `(h
^z>%  
Response.End n
AWb9Yk  
End If %jy$4qAf%  
Next ;b
*qunJ3L  
Next L7;~4_M9.V  
End If oe]*Q  
%> KD,3U/3  
第3中方法需要你自己建个数据库表