防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ "1WwSh}Z  
iVwI}%k  
试试这两种方法: \M<C6m5  
第一种： wwk=*X-8  
squery=lcase(Request.ServerVariables("QUERY_STRING")) \za 0?b  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) ^
vfp;  
<mi*AY  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" I
6X_DPY  
9qIjs$g  
SQL_inj = split(SQL_Injdata,"|") "0pu_  
W(Xb]t=19  
For SQL_Data=0 To Ubound(SQL_inj) c|IH|y  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then l/#;GYB]  
Response.Write "SQL通用防注入系统" %h(J+_"L6  
Response.end YyjnyG  
end if Xw_AZ-|1D  
next ~~ ;J[Fp  

)jm}h7,  
%?@N-$j  
y C(xi"!  
第二种： (TgLCT[@T  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" E.zY(#S  
aF]4%E  
SQL_inj = split(SQL_Injdata,"|") {OH"d  
p0
>W}+8fF  
If Request.QueryString<>"" Then T}M!A|   
For Each SQL_Get In Request.QueryString Me_.X_  
For SQL_Data=0 To Ubound(SQL_inj) Wz;7 |UC  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then NirG99kyo  
Response.Write "SQL通用防注入系统" ,l1A]Wx  
Response.end JPRo<jt=  
end if STtjkZ6  
next W&T
-E,  
Next |eU{cK~e^  
End If ..)O/g.  
.}=gr+<bf  
If Request.Form<>"" Then Lzm9K
h;  
For Each Sql_Post In Request.Form F4`ud;1H  
For SQL_Data=0 To Ubound(SQL_inj) 33:{IV;k  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then NI,i)OSEN  
Response.Write "SQL通用防注入系统" . =yF  
Response.end ?:H4Xd7  
end if 4l_!OUvt  
next  _xjw:  
next Pp#  
end if 3"!h+dXw  
h/?$~OD  
第三种 +" |?P  
<% Utd`T+AF*  
'--------定义部份------------------ 62)Qr  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr DP_ ]\V<sT  
'自定义需要过滤的字串,用 "■"分离 1wAD_PI|BH  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" lkl+o&D9  
'---------------------------------- waT'|9{  
%> q|r^)0W  
;&RBg+Pr  
<% d< j+a1&  
Str_Inf = split(Str_In,"■") KW`^uoY$  
'--------POST部份------------------ lC|`DG-B  
If Request.Form<>"" Then QMwrt  
For Each Str_Post In Request.Form vP;  
z0
!k  
For Str_Xh=0 To Ubound(Str_Inf) |zd+ \o  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then 0wQ'~8  
'--------写入数据库----------头----- gc,%A'OR^<  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" |Y"nZK,  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") !Pd@0n4  
Str_db.open Str_dbstr VC~1QPC9  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") NhG?@N  
Str_db.close a=@]Ov/  
Set Str_db = Nothing 1u>[0<U~E  
'--------写入数据库----------尾----- icS%])3LF  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 57@6O-t-  
Response.Write "非法操作！系统做了如下记录:<br>"
w5Lev}Rb  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" N5_`  
Response.Write "操作时间："&Now&"<br>" W 2yNwB+{  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" %'+}-w  
Response.Write "提交方式：POST<br>" f"9aL= 3  
Response.Write "提交参数："&Str_Post&"<br>" {8]Yqx)1]]  
Response.Write "提交数据："&Request.Form(Str_Post) #$n >+lc  
Response.End %JoHc?  
End If bAOL<0RS9`  
Next Wz{,N07Q#{  
6Uh_&?\%  
Next 6,Z.RT{5  
End If [L(qrAQ2|z  
'---------------------------------- ]WFr5  
[A\DuJx  
'--------GET部份------------------- Y2$wL9">  
If Request.QueryString<>"" Then e\)r"!?H`  
For Each Str_Get In Request.QueryString c6-~PKJ L  
S,0h &A9  
For Str_Xh=0 To Ubound(Str_Inf) \*yH33B9  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then Y.yi
Uf/Q  
'--------写入数据库----------头----- -,:^dxE'  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 7C / ^Gw  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") C}jFR] x)  
Str_db.open Str_dbstr x_L5NsO:  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") }jdMo83  
Str_db.close +6~ut^YiM.  
Set Str_db = Nothing r_ >]y p  
'--------写入数据库----------尾----- VcX89c4\  
 6K C
v
 
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" T:/mk`>  
Response.Write "非法操作！系统做了如下记录:<br>" h8XoF1wuw  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" fbg:rH\_  
Response.Write "操作时间："&Now&"<br>" -8zdkm8k  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" qzk!'J3*r<  
Response.Write "提交方式：GET<br>" 9u?[{h.`B  
Response.Write "提交参数："&Str_Get&"<br>" >uLWfk+y1  
Response.Write "提交数据："&Request.QueryString(Str_Get) s$g3_
_|Y  
Response.End `@3{}  
End If nz2`YyR  
Next 2y`X)  
Next E|_J  
End If .o#A(3&n  
%> K]SsEsd  
第3中方法需要你自己建个数据库表