防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ `Fz\wPd  
fm[_@L% x  
试试这两种方法: C{DlcZ<  
第一种： b{zAJ`|#[n  
squery=lcase(Request.ServerVariables("QUERY_STRING")) zoJ_=- *s  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) /A0 [_  
%3ou^mcj  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" Gg'<Q. H  
!T)T_P[  
SQL_inj = split(SQL_Injdata,"|") P"oYC$  
|*Of^IkG0  
For SQL_Data=0 To Ubound(SQL_inj) xq#U4 E  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then #,7eQaica  
Response.Write "SQL通用防注入系统" m*\B2\2gJ  
Response.end ?e"Wu+q~L  
end if Cc@=?  
next w9/nVu  
R|nEd/'<  
"w(N62z/  
|if~i;VKL  
第二种： xi;/^)r  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" (zj z]@qJ  
2f`WDL  
SQL_inj = split(SQL_Injdata,"|") N[#iT&@T}/  
MV% :ES?  
If Request.QueryString<>"" Then E]e,cd  
For Each SQL_Get In Request.QueryString lv=yz\  
For SQL_Data=0 To Ubound(SQL_inj) \8=e|a5`  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then ,}eRnl
\  
Response.Write "SQL通用防注入系统" YCirOge  
Response.end ~8XX3+]z:X  
end if }DJ|9D^yf  
next ;r gH}r  
Next J'I1,5(  
End If N>Vacc_[  
%~][?Y ><  
If Request.Form<>"" Then (y-x01H  
For Each Sql_Post In Request.Form W`w5jk'0^=  
For SQL_Data=0 To Ubound(SQL_inj) 
i<B:  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then MMd0O X)P  
Response.Write "SQL通用防注入系统" #;wkr))  
Response.end {E;2&d  
end if #;5[('&[  
next $
,8CH)w  
next
muL>g_H  
end if k&MlQ2'!<  
!w @1!Xpn1  
第三种 UOn!Y@  
<% b24NL'jm  
'--------定义部份------------------ (45NZBs  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr L2[Ei|9_  
'自定义需要过滤的字串,用 "■"分离 Uuwq7oFub  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" 2N L:\%wz  
'---------------------------------- gJ<@;O8zu0  
%> 5%2ef{T[  
JZs|~@  
<% |WD,\=J2  
Str_Inf = split(Str_In,"■") sN6 0o 7.  
'--------POST部份------------------ 73'U#@g6  
If Request.Form<>"" Then dE 3i=  
For Each Str_Post In Request.Form #]5&mKi  
l81&[  
For Str_Xh=0 To Ubound(Str_Inf) 7JxE|G  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then ~AEqfIx*^&  
'--------写入数据库----------头----- _#/!s]$d#  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" R59
e &   
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 1mT|o_K{ T  
Str_db.open Str_dbstr =-OCM*5~S  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") [$ hptQv  
Str_db.close 54` bE$:+  
Set Str_db = Nothing 3g?MEM~  
'--------写入数据库----------尾----- u@GR
N`yn  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" @ChN_gd
3!  
Response.Write "非法操作！系统做了如下记录:<br>" mXxZM;P[  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" dNR7e   
Response.Write "操作时间："&Now&"<br>" -&qRo0^3
 
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" k
A7~Yu5|  
Response.Write "提交方式：POST<br>" =XZF.ur  
Response.Write "提交参数："&Str_Post&"<br>" U@o2gjGN  
Response.Write "提交数据："&Request.Form(Str_Post) Qh)|FQ[s$r  
Response.End m1^dT_7Z  
End If wJapGc!   
Next o8~ f  
^2&O3s
  
Next N+Q(V*:3v  
End If s[0prm5.  
'---------------------------------- [_g#x(=  
<7vIh0  
'--------GET部份------------------- 5QqJI#4~  
If Request.QueryString<>"" Then Ma`   
For Each Str_Get In Request.QueryString IeRl6r%:  
xTa4.ZXg  
For Str_Xh=0 To Ubound(Str_Inf) c,6<7  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then K$Mx}m7l  
'--------写入数据库----------头----- 3EbnZb  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" H B::0l<  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") wc<2Uc  
Str_db.open Str_dbstr R-g>W  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") a}5vY  
Str_db.close _9}x
2uO~  
Set Str_db = Nothing o1fyNzq<  
'--------写入数据库----------尾----- 4f@havFIJ  
xm<5S;E5U4  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" "-0pz\a  
Response.Write "非法操作！系统做了如下记录:<br>" "@c';".|  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" yDCooX0  
Response.Write "操作时间："&Now&"<br>" v`z=OHc  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" ]ro1{wm!WU  
Response.Write "提交方式：GET<br>" "Cb.cO$i;  
Response.Write "提交参数："&Str_Get&"<br>" [oQ`HX1g  
Response.Write "提交数据："&Request.QueryString(Str_Get) afxj[;p!  
Response.End q;1VF;<"vH  
End If IQ(]66c,  
Next ?`vM#)  
Next 1jZDw~  
End If /o<}]]YBF  
%> NPB,q& Th  
第3中方法需要你自己建个数据库表