防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ =VIU  
*rKj%Me  
试试这两种方法: <"/b 5kc  
第一种： 5rp,xk!  
squery=lcase(Request.ServerVariables("QUERY_STRING")) D)shWJRlvW  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) 9dS<^E(ZF  
5SV w71*  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" P:D@5  
0\tV@ 6p2=  
SQL_inj = split(SQL_Injdata,"|") cft/;Au{  
6=N!()s  
For SQL_Data=0 To Ubound(SQL_inj) E~}@56ER}  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then 9;2{=,  
Response.Write "SQL通用防注入系统" xXb7/.*qE  
Response.end +vf~s^  
end if qmmQHS  
next N"/J1   
CE,0@%6F*  
WAq)1gwN  
$-
^ ;Jl  
第二种： m[aBHA^g  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 1fgO3N  
b'AA*v,b  
SQL_inj = split(SQL_Injdata,"|") up_Qv#`Q  
+az=EF  
If Request.QueryString<>"" Then j(aok5:e  
For Each SQL_Get In Request.QueryString #su R[K*S  
For SQL_Data=0 To Ubound(SQL_inj) aI.5w9  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then I{nrOb1G(  
Response.Write "SQL通用防注入系统" Y@(izC&h  
Response.end IKo,P$ PE  
end if Rtywi}VV2  
next OQnb^fabY  
Next !LI 8Xk  
End If &VPfI  
Q*
jNJ^IW  
If Request.Form<>"" Then gn-@OmIs  
For Each Sql_Post In Request.Form t[e`wj+qz  
For SQL_Data=0 To Ubound(SQL_inj) cQzUR^oq,  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then \9t/*%:  
Response.Write "SQL通用防注入系统" . E8Gj'yO  
Response.end C[ma !he  
end if ol3].0Vc]  
next Pk?M~{S  
next g9~QNA  
end if eP( |]Rk  
+HDfEo T  
第三种 DhVO}g)2#  
<% DpbprT7_  
'--------定义部份------------------ bU $f4J  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr R6m6bsZ`  
'自定义需要过滤的字串,用 "■"分离 y.>1r7  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" } "QL"%  
'---------------------------------- c`Q#4e]%_  
%> \d)HwO  
J;DTh ]z?:  
<% tl6x@%\  
Str_Inf = split(Str_In,"■") \Gl>$5np  
'--------POST部份------------------ >mAi/TZC  
If Request.Form<>"" Then }Y~<|vZ  
For Each Str_Post In Request.Form Ll$,"}0T  
D[p_uDIz  
For Str_Xh=0 To Ubound(Str_Inf) yDapl(  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then X_HU?Q_N  
'--------写入数据库----------头----- q2+`a;_
S  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" MSqW {  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ~o8  
Str_db.open Str_dbstr +b sc3  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") ]]Fe:>  
Str_db.close MV.&GUez{  
Set Str_db = Nothing 61SbBJ6[  
'--------写入数据库----------尾----- f]4j7K!e]  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" |S6L[Uo  
Response.Write "非法操作！系统做了如下记录:<br>" %\f<N1~*  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" %/n#{;c#  
Response.Write "操作时间："&Now&"<br>" A)9F_;BY  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" mYx6JU*`  
Response.Write "提交方式：POST<br>" .;J6)h  
Response.Write "提交参数："&Str_Post&"<br>" mI>=S  
Response.Write "提交数据："&Request.Form(Str_Post) r=gF&Og,?  
Response.End 1xTNrLW  
End If vJ?j#Ch  
Next )+ (GE  
Ir6(EIwx0  
Next 1j_ 6Sw(  
End If cj;k{Moc  
'---------------------------------- )NLjv=ql  

B<{Yj}..  
'--------GET部份------------------- L3;cAb/  
If Request.QueryString<>"" Then 'z9}I #  
For Each Str_Get In Request.QueryString b3.}m[]  
o}b_`O  
For Str_Xh=0 To Ubound(Str_Inf) =G \N1E  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then s&d!+-\6_  
'--------写入数据库----------头----- X..<U}e
 
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" U[O7}Nsb"  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ^aI$97Li  
Str_db.open Str_dbstr T9NTL
\;  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") aY8QYK ;?^  
Str_db.close Uz_OUTFM  
Set Str_db = Nothing ET0^_yk  
'--------写入数据库----------尾----- oiRrpS\T.  
X
Xg~eu?  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" jPIOBEIG  
Response.Write "非法操作！系统做了如下记录:<br>" ubs>(\`q"  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 5~FXy{ZIH  
Response.Write "操作时间："&Now&"<br>" ]G}:cCpd+a  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" <4:%M  
Response.Write "提交方式：GET<br>" 7pO/! Lm  
Response.Write "提交参数："&Str_Get&"<br>" (`"87Xomnn  
Response.Write "提交数据："&Request.QueryString(Str_Get) o?| ] ciY  
Response.End z1m-t#
v:  
End If yPoa04!{=  
Next E#n=aY~u-  
Next nV/;yl4e{  
End If $D
eVXW  
%> m)ENj6A>yP  
第3中方法需要你自己建个数据库表