防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ ?
PL Pf>e  
/|w6:;$;mn  
试试这两种方法: _IMW{  
第一种： /*~EO{o  
squery=lcase(Request.ServerVariables("QUERY_STRING")) @ 6\I~s(  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) hXw]K"  
3qgS&js 7  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" kb%;=t2  
ME$[=?7XX  
SQL_inj = split(SQL_Injdata,"|") B
X/8O<s0  
a9e>iU  
For SQL_Data=0 To Ubound(SQL_inj) #&+{mCjs  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then t mntp
 
Response.Write "SQL通用防注入系统" P.se'z)E  
Response.end ]|pe>:gf'  
end if _oL?*ks  
next _rMg}F"  
*][`@@->  
@/~om g}R  
u~N?NW Q  
第二种： (y'hyJo  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 'ycJMYP8  
PN%zIk bo  
SQL_inj = split(SQL_Injdata,"|") [|wZ77\  
OG~gFZr)6  
If Request.QueryString<>"" Then Y>z>11yEB0  
For Each SQL_Get In Request.QueryString Sz $ ~P9  
For SQL_Data=0 To Ubound(SQL_inj) ZmqKQO  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then \
<h0Q,e  
Response.Write "SQL通用防注入系统" ')Zvp7>$  
Response.end },?kk1vIT{  
end if Ju
mgb
 
next /V8#[9K  
Next ,]C;sN%~}  
End If gaxsv[W>^  
R{4^t97wH{  
If Request.Form<>"" Then P:S.~Jq  
For Each Sql_Post In Request.Form 9=M$AB  
For SQL_Data=0 To Ubound(SQL_inj) FXCMR\
BsQ  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then g/_5unI}u  
Response.Write "SQL通用防注入系统" 5~U/  
Response.end ^e5=hH-%  
end if ( Rh,,  
next 3NqB <J  
next 8%mu8l  
end if /62!cp/F/D  
@7c?xQVd$  
第三种 Ny7S  
<% \7eUw,~Q>  
'--------定义部份------------------ /HE
w-M9z  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr "cGk)s  
'自定义需要过滤的字串,用 "■"分离 7WqH &vU|  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" Es`Px_k  
'---------------------------------- s)t@ol  
%> p>N(Typ0b  
;d$rdFA_  
<% <}Vrl`?h  
Str_Inf = split(Str_In,"■") +E+p"7  
'--------POST部份------------------
//MUeTxR  
If Request.Form<>"" Then bs&4
3A
e  
For Each Str_Post In Request.Form s^TZXCyF o  
sdrfsrNvB-  
For Str_Xh=0 To Ubound(Str_Inf) \K{ z  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then @{e}4s?7od  
'--------写入数据库----------头----- AN m d!  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 9R L`<,Q  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 8`{:MkXP  
Str_db.open Str_dbstr P;no?  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") @bLy,Xr&  
Str_db.close Q*cf
(  
Set Str_db = Nothing pF
>i-i  
'--------写入数据库----------尾----- Po0A#Zl  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" dQX6(Jj  
Response.Write "非法操作！系统做了如下记录:<br>" iVr JQ  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" T~e.PP  
Response.Write "操作时间："&Now&"<br>" a~w$#fo"`f  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" C6PdDRf  
Response.Write "提交方式：POST<br>" #6=  
Response.Write "提交参数："&Str_Post&"<br>" 0l6.<-f{  
Response.Write "提交数据："&Request.Form(Str_Post) f:} x7_Q  
Response.End Gc|idjW4  
End If ms]sD3z/W+  
Next 4hj|cCrO  
mzgfFNm^G)  
Next 0H:X3y+  
End If ?@86P|19  
'---------------------------------- hgq;`_;1,  
7[)E>XRE  
'--------GET部份------------------- *EH~_F  
If Request.QueryString<>"" Then XL^GZ  
For Each Str_Get In Request.QueryString zDG b7S{  
UK!(G  
For Str_Xh=0 To Ubound(Str_Inf) ]/v[8dS(l  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then ;V!D:5U  
'--------写入数据库----------头----- |BXg/gW  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ]f_p8?j"  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") upmx $H>  
Str_db.open Str_dbstr 9*M,R,y  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") xqh  
Str_db.close QXK{bxwC  
Set Str_db = Nothing !a\^Sk /  
'--------写入数据库----------尾----- =s6 opL)  
a7opCmL  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" Bzf^ivT3L  
Response.Write "非法操作！系统做了如下记录:<br>" %N._w!N<5n  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" [ /r(__.  
Response.Write "操作时间："&Now&"<br>" $&c*'3  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" L4W5EO$  
Response.Write "提交方式：GET<br>" z$sT !QL~  
Response.Write "提交参数："&Str_Get&"<br>" h*\%
vr  
Response.Write "提交数据："&Request.QueryString(Str_Get) /n&&Um\  
Response.End RRJ%:5&  
End If 9(Xn>G'iT  
Next F== p<lrs  
Next {JLtE{  
End If 5 qA'  
%> :ws<-Qy  
第3中方法需要你自己建个数据库表