防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ J?m/
u6  
"i#g [x  
试试这两种方法: GIEQD$vy  
第一种： rrRv 7J&Q  
squery=lcase(Request.ServerVariables("QUERY_STRING")) ^uUA41o`eJ  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) B2]52Fg-"  
~$K{
E[^<  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" t{iRCj  
fTPm Fb  
SQL_inj = split(SQL_Injdata,"|") /+%aSPQ  
>v@3]a i  
For SQL_Data=0 To Ubound(SQL_inj) *w*K&$g  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then P jBAf'  
Response.Write "SQL通用防注入系统" jnOnV1I"  
Response.end Yl&[_ l  
end if q:)Pf P+  
next Pv2uZH(  
>qNpY(Q l  
Nkj$6(N=zJ  
U"8Hw@  
第二种： H ;=^ W  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" MF'Z?M  
l VD{Y`)  
SQL_inj = split(SQL_Injdata,"|") h.#:7d(g  
P=,\wM6T|  
If Request.QueryString<>"" Then `mteU"{bx  
For Each SQL_Get In Request.QueryString 0`7yPq*  
For SQL_Data=0 To Ubound(SQL_inj) HoAg8siQ  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ck0%H#BYY  
Response.Write "SQL通用防注入系统" k;cX,*DIn  
Response.end M| Gl&   
end if I ]o|mjvs  
next ~L<"]V+B  
Next .qohHJ&  
End If SS%Bde&<{  
| 8mWR=9fs  
If Request.Form<>"" Then .^9khKJ;  
For Each Sql_Post In Request.Form 2_u+&7  
For SQL_Data=0 To Ubound(SQL_inj) "1Hn?4nz5  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then WcSvw  
Response.Write "SQL通用防注入系统" 5<*ES[S  
Response.end }(u:K}8  
end if :n13v@q  
next &PV%=/-J  
next #$S~QS. g  
end if ${z#{c1  
^"|q~2  
第三种 ;yNY/  
<% S>T ;`,  
'--------定义部份------------------ OW};i|  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 8*/;W&7y  
'自定义需要过滤的字串,用 "■"分离 };rp2 5i  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" Axb=1_--  
'---------------------------------- b`+ yNf  
%> C)i8XX  
)=}qAVO8  
<% &_:9.I1  
Str_Inf = split(Str_In,"■") Bq)dqLwk  
'--------POST部份------------------ J#Y0R"fo  
If Request.Form<>"" Then [n/c7Pe  
For Each Str_Post In Request.Form HRE?uBkjf  
{'+{ASpO!  
For Str_Xh=0 To Ubound(Str_Inf) X);'[/]E*  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then $S<B\\ %  
'--------写入数据库----------头----- ?Ybq]J\q  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" HN`qMGW^  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") rWJ5C\R  
Str_db.open Str_dbstr 5SUO`4L  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')")  YC6guy>  
Str_db.close 9>-6Y  
Set Str_db = Nothing B<BS^waU  
'--------写入数据库----------尾----- R[\1Kk(Zo  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 6c^?DLy9B  
Response.Write "非法操作！系统做了如下记录:<br>" Cx~;oWZ  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" ~Sb)i f  
Response.Write "操作时间："&Now&"<br>" ?`xF>P]M  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" m,kYE9{  
Response.Write "提交方式：POST<br>" C=oeRc'r1W  
Response.Write "提交参数："&Str_Post&"<br>" VOr:G85*s  
Response.Write "提交数据："&Request.Form(Str_Post) x[TLlV:{  
Response.End ,\ 1X\  
End If 8vq
-|p  
Next C;:=r:bth  
^`lDw  
Next hfIP   
End If >CrrxiG  
'---------------------------------- QlB9m2XB  
t=}]4&Yp  
'--------GET部份------------------- RYvdfj.ij  
If Request.QueryString<>"" Then O&/nBHu\  
For Each Str_Get In Request.QueryString ?0dmw?i  
hx@@[sKF7  
For Str_Xh=0 To Ubound(Str_Inf) (|AZO!  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then ,(h-  
'--------写入数据库----------头----- L7<30"7  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ^#e|^]] L  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ENqZ=Lyq  
Str_db.open Str_dbstr Z}0{FwW"4  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") YBj*c$.D0  
Str_db.close ^C~_}/cZ  
Set Str_db = Nothing y-H9fWi8Y&  
'--------写入数据库----------尾----- -!7Z  
 ]XlBV-@b  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ygja{W.  
Response.Write "非法操作！系统做了如下记录:<br>" \(Nx)F  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" d`V.i6u  
Response.Write "操作时间："&Now&"<br>" b7^q(}qE  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ;k@]"& t  
Response.Write "提交方式：GET<br>" z0\ $#r^I  
Response.Write "提交参数："&Str_Get&"<br>" e}{#VB<  
Response.Write "提交数据："&Request.QueryString(Str_Get) :](#W@ r  
Response.End o<lmU8xB=  
End If b4^O=  
Next )P9]/y  
Next i^:#*Q-co  
End If "
[]oWPOj  
%> gzhIOeY  
第3中方法需要你自己建个数据库表