防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ [.4R ,[U  
^|y6o
j  
试试这两种方法: eq.K77El{J  
第一种： wy6>^_z  
squery=lcase(Request.ServerVariables("QUERY_STRING")) *O-1zIlp  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) &No6k~T0:b  
hR,VE'A  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" UMR0S5`}  
fP>_P#gZ  
SQL_inj = split(SQL_Injdata,"|") MMCac6;Aea  
Z7RGOZQ}G  
For SQL_Data=0 To Ubound(SQL_inj) ?8[,0l:|  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then yoa"21E$  
Response.Write "SQL通用防注入系统" `s#0/t  
Response.end ^$qr6+  
end if 4zuM?Dp  
next #(&!^X3  
3 EH/6  

z`UL)W  
'Lu7cb^  
第二种： A6ipA/_  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" Nq'Cuwsp  
KrE:ilm#^Y  
SQL_inj = split(SQL_Injdata,"|") "jBrPCB 8  
h|OqM:J
;  
If Request.QueryString<>"" Then ceBu i8a |  
For Each SQL_Get In Request.QueryString [ of{~  
For SQL_Data=0 To Ubound(SQL_inj) y<mmv~=  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then D /ysS$!{  
Response.Write "SQL通用防注入系统" ?"f\"N  
Response.end xc)A`(g  
end if B:S/ ?v  
next `tA~"J$32l  
Next =H&{*Ja  
End If kKr|PFz  
&LM@_P"T  
If Request.Form<>"" Then am.}2QZU  
For Each Sql_Post In Request.Form ;;rEv 5 /  
For SQL_Data=0 To Ubound(SQL_inj) _j{^I^P  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then t mAj  
Response.Write "SQL通用防注入系统" T0BFit6  
Response.end Eukj2a  
end if ~]X4ru5,4  
next [=*c8  
next v`3q 0,,  
end if v0euvs  
4_qd5K+n"  
第三种 gwE#,OY*  
<% OZ 4uk.)  
'--------定义部份------------------ - JOtvJIQI  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr 55xaZ#|  
'自定义需要过滤的字串,用 "■"分离 2g
shiY8_  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" '>dsROB->  
'---------------------------------- >zcR ?PPs  
%> |uo<<-\jTO  
I^|6gaP|6  
<% _kUf[&  
Str_Inf = split(Str_In,"■") LWgYGXWT"  
'--------POST部份------------------ sYnf #'  
If Request.Form<>"" Then w$I<WS{J:Z  
For Each Str_Post In Request.Form #\9sCnb  
J.'}R2gT1  
For Str_Xh=0 To Ubound(Str_Inf) F<SMU4]YdG  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then BeP]M1\?>  
'--------写入数据库----------头----- sLiKcR8^  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" ,)%al76E  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ! bbVa/  
Str_db.open Str_dbstr :m*
r(i3  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") UjLZ!-}  
Str_db.close P,5gaT)  
Set Str_db = Nothing yZ?|u57  
'--------写入数据库----------尾----- d*3;6ZLy  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" ;M{@|z[Nv  
Response.Write "非法操作！系统做了如下记录:<br>"
ZL[~[  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" gP=(2EVE  
Response.Write "操作时间："&Now&"<br>" mlC_E)Ed5  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" !Ra.DSL  
Response.Write "提交方式：POST<br>" L=Cm0q 3v  
Response.Write "提交参数："&Str_Post&"<br>" v+XB$j^H  
Response.Write "提交数据："&Request.Form(Str_Post) XBQ]A89G  
Response.End ={&}8VA  
End If 0}:- t^P  
Next uNnx i  
gC^4K9g  
Next 9pAklD4  
End If bxX[$ q  
'---------------------------------- =7%1]  
rP
aUDR4U  
'--------GET部份------------------- 3[8F:I0UL  
If Request.QueryString<>"" Then iW.4'9  
For Each Str_Get In Request.QueryString UeNa  
I 4]|r k9  
For Str_Xh=0 To Ubound(Str_Inf) .)Xyzd  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then (p4|,\+  
'--------写入数据库----------头----- YC!Tgb~H  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" QC@nRy8%  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") b+/XVEsr  
Str_db.open Str_dbstr "fWAp*nI3t  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") t(3<w)r2  
Str_db.close /C)mx#h]  
Set Str_db = Nothing i}SJ   
'--------写入数据库----------尾----- S[!sJ-rG  
ul[edp_  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" .b'o}DLa  
Response.Write "非法操作！系统做了如下记录:<br>" ')C%CAYW  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" |eS5~ 0<`  
Response.Write "操作时间："&Now&"<br>" {m1=#*  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 9WN4eC$  
Response.Write "提交方式：GET<br>" GFM$1}  
Response.Write "提交参数："&Str_Get&"<br>" AIZs^ `_  
Response.Write "提交数据："&Request.QueryString(Str_Get) .48Csc-  
Response.End W 2/`O?  
End If >y&Db  
Next MbY?4i00%h  
Next ,G2]3 3Z  
End If Fkgnc{NI  
%> E.*TJ  
第3中方法需要你自己建个数据库表