防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ Eaf6rjD  
k|(uIU* ]  
试试这两种方法: swss#?.se  
第一种： $,ZBK6CT  
squery=lcase(Request.ServerVariables("QUERY_STRING")) (j@3=-%6G  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) sOhQu>gN  
K;a]
+9C  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" $b,o3eC  
w] i&N1i  
SQL_inj = split(SQL_Injdata,"|") d9^ uEz(  
rvgArFf}]  
For SQL_Data=0 To Ubound(SQL_inj) /o Q^j'v  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then h:\WW;s[B  
Response.Write "SQL通用防注入系统" $p#)xx7  
Response.end ] vo&NE  
end if j"{|* _6E_  
next J!b v17H"  
u,mC`gz  
/>=)=CGv;  
fjVGps$j  
第二种： Km7HB!=<  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" (RW02%`jjy  
t
gCEz%  
SQL_inj = split(SQL_Injdata,"|") _Q_"_*e  
kq&xH;9=.  
If Request.QueryString<>"" Then !ba /]A
/  
For Each SQL_Get In Request.QueryString j qfxQ
  
For SQL_Data=0 To Ubound(SQL_inj) |75>8;  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then 3)b[C&`  
Response.Write "SQL通用防注入系统" e<2?O  
Response.end Xxh zzm-B  
end if KAVe~j"  
next t}n:!v"|+O  
Next ZV=O oLt,  
End If UIPi<_Xa  
r`Y [XzT9  
If Request.Form<>"" Then -'ePx f  
For Each Sql_Post In Request.Form e"Kg/*Ji1  
For SQL_Data=0 To Ubound(SQL_inj) A Ch!D>C1  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then wqEO+7)S  
Response.Write "SQL通用防注入系统" z UN&L7D  
Response.end E&ou(Q={  
end if B QmH
Yar  
next *{5p/}p  
next YC+}H33  
end if _+73Y'  
|3j'HN 5S  
第三种 \X1?,gV_  
<% `"`/_al^  
'--------定义部份------------------ Jn!-Wa,  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr {>$i)B  
'自定义需要过滤的字串,用 "■"分离 5i `q  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" BV_rk^}Ur  
'---------------------------------- ^x8*]Sz#x  
%> lM oi5q  
f"My;K$l;  
<% d~n|F|`:  
Str_Inf = split(Str_In,"■") //
T1e7)  
'--------POST部份------------------ +0)s{?  
If Request.Form<>"" Then M*li;  
For Each Str_Post In Request.Form nQm7At  
/Z`("X?_Kf  
For Str_Xh=0 To Ubound(Str_Inf) @AET.qGC  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then ~IrrX,mp:  
'--------写入数据库----------头----- {/d<Jm:  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" |TRl>1rv  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") ur JR[$p  
Str_db.open Str_dbstr ~^v*f  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')")
5D<"kT  
Str_db.close Ox^VU2K;&.  
Set Str_db = Nothing J"?jaa2~  
'--------写入数据库----------尾----- p.RSH$]  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" (Nn)_caVb  
Response.Write "非法操作！系统做了如下记录:<br>" oA`G\Xh_E  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" 5z@QAQ  
Response.Write "操作时间："&Now&"<br>" +x)x&;B)/  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" 8ps1Q2|  
Response.Write "提交方式：POST<br>" 'da$i  
Response.Write "提交参数："&Str_Post&"<br>" b.mWB`59  
Response.Write "提交数据："&Request.Form(Str_Post) GN=-dLN  
Response.End G`R_kg9$  
End If .s`7n *xz  
Next +1>\o|RF  
G4{TJ,~  
Next RWdx)qj{  
End If K/|qn)  
'---------------------------------- m=qyPY  
4R28S]Gb  
'--------GET部份------------------- qLk7C0  
If Request.QueryString<>"" Then nna boD  
For Each Str_Get In Request.QueryString wt1Y&D  
a8
cX{6  
For Str_Xh=0 To Ubound(Str_Inf) }cd-BW  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then a{+;&j[!  
'--------写入数据库----------头----- `XK#sCC  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" 22gh,e2o  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 4\iy{1{E,C  
Str_db.open Str_dbstr #/o1D^  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") I!Uj~jV  
Str_db.close m4 :"c"  
Set Str_db = Nothing .Dt.7G  
'--------写入数据库----------尾----- :,pdR>q%(y  
K(heeZUt  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" ~09kI O)  
Response.Write "非法操作！系统做了如下记录:<br>" Ie 'iAY  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" )O$T; U  
Response.Write "操作时间："&Now&"<br>" '$y.`/$  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" TykY>cl   
Response.Write "提交方式：GET<br>" l^;=0UR_  
Response.Write "提交参数："&Str_Get&"<br>" szas(7kDS  
Response.Write "提交数据："&Request.QueryString(Str_Get) y7-daek  
Response.End 9ve)+Lk  
End If G^A}T3  
Next =fcRH:B:  
Next Tk:%
YS;=  
End If Oi$$vjs2  
%> 2,e>gP\]  
第3中方法需要你自己建个数据库表