防SQL注入程序代码 [复制链接]

一般站点安全首先要考虑到的是SQL注入的防范，下面就是一些通用的 防sql注入代码！ *b&|  
W;=ZQ5Lw  
试试这两种方法: \21!NPXH2  
第一种： n3(HA  
squery=lcase(Request.ServerVariables("QUERY_STRING")) Z1Wra-g  
sURL=lcase(Request.ServerVariables("HTTP_HOST")) `)'YU^s  
wNlp4Z'[  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" ~L2Fo~fw  
0^+W"O  
SQL_inj = split(SQL_Injdata,"|") IoC,\$s ,  
(f)QEho7  
For SQL_Data=0 To Ubound(SQL_inj) Vh&uSi1V  
if instr(squery&sURL,Sql_Inj(Sql_DATA))>0 Then <%5ny!]  
Response.Write "SQL通用防注入系统" 4 QWHGh "  
Response.end S7bSR?~L[  
end if e*tOXXY1  
next @c.pOX[]m,  
W+QI D/  
TtzB[F  
hYLu   
第二种： x-[l`k.V  
SQL_injdata =":|;|>|<|--|sp_|xp_|\|dir|cmd|^|(|)|+|$|'|copy|format|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare" 9I,Trk@&  
Q-\: u~  
SQL_inj = split(SQL_Injdata,"|") BEw(SQH  
0:XmReO+k  
If Request.QueryString<>"" Then ^dro*a,  
For Each SQL_Get In Request.QueryString QZX+E   
For SQL_Data=0 To Ubound(SQL_inj) %EuSP0  
if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then J? C"be=  
Response.Write "SQL通用防注入系统" &:rf80`z.  
Response.end L(.5:&Y=`  
end if ){v nmJJ%  
next [Mx+t3M  
Next
J&Ah52  
End If y0xte&  
j9%=^ZoQj  
If Request.Form<>"" Then [8ih-k  
For Each Sql_Post In Request.Form hQ9VcS6=gD  
For SQL_Data=0 To Ubound(SQL_inj) ^Oo%`(D?  
if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then +U[A.^t  
Response.Write "SQL通用防注入系统" ?n}L+|  
Response.end ~sOAm  
end if @ Fu|et  
next [|v
dr.  
next IMj{n.y4  
end if % 74}H8q_z  
.A E(D7d6  
第三种 )/UkJ/}j  
<% 7Xa Ri@uG  
'--------定义部份------------------ N)QW$iw9  
Dim Str_Post,Str_Get,Str_In,Str_Inf,Str_Xh,Str_db,Str_dbstr >6c{CYuT  
'自定义需要过滤的字串,用 "■"分离 Ta_#Rg*!  
Str_In = "'■;■and■exec■insert■select■delete■update■count■*■%■chr■mid■master■truncate■char■declare" 8{AzB8xp  
'---------------------------------- GE|V^_|i  
%> `,J\E<4J  
[L:,A{rve  
<% -{HA+YL H  
Str_Inf = split(Str_In,"■") I'JFt>]  
'--------POST部份------------------ `U(FdT  
If Request.Form<>"" Then bYiaJ  
For Each Str_Post In Request.Form zFlW\wc  
Wa wOap  
For Str_Xh=0 To Ubound(Str_Inf) &U:;jlST9  
If Instr(LCase(Request.Form(Str_Post)),Str_Inf(Str_Xh))<>0 Then $. Ih-   
'--------写入数据库----------头----- V V<Zl  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" n;[ d{bU  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") LqNsQu";  
Str_db.open Str_dbstr f|u!?NGl  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','POST','"&Str_Post&"','"&replace(Request.Form(Str_Post),"'","''")&"')") tks1*I$S<  
Str_db.close WmeV[iI  
Set Str_db = Nothing k/>k&^?  
'--------写入数据库----------尾----- @,
$>H7o  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！');</Script>" 3{CXIS  
Response.Write "非法操作！系统做了如下记录:<br>" p~qdkA<  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" Zv-#v  
Response.Write "操作时间："&Now&"<br>" }}<^fM  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" up1kg>i%"  
Response.Write "提交方式：POST<br>" t\ ym4`"  
Response.Write "提交参数："&Str_Post&"<br>" J%{>I  
Response.Write "提交数据："&Request.Form(Str_Post) O.i.<VD7  
Response.End o^mW`g8[  
End If i! (u4wTFF  
Next qeypa!  
29:] cL(5  
Next Pa+%H]vB  
End If nw f(`=TC  
'---------------------------------- XsEDI?p2  
W2'u]1bs  
'--------GET部份------------------- n&Bg pt~  
If Request.QueryString<>"" Then w=,bF$:fIW  
For Each Str_Get In Request.QueryString ^DD ]jx  
)m|)cLT&  
For Str_Xh=0 To Ubound(Str_Inf) W|4:3c4  
If Instr(LCase(Request.QueryString(Str_Get)),Str_Inf(Str_Xh))<>0 Then \Cx2$<8  
'--------写入数据库----------头----- ';Y0qitGB  
Str_dbstr="DBQ="+server.mappath("SqlIn.mdb")+";DefaultDir=;DRIVER={Microsoft Access Driver (*.mdb)};" +xp)la.  
Set Str_db=Server.CreateObject("ADODB.CONNECTION") 2)-Umq{]{  
Str_db.open Str_dbstr 0l;TZf=H  
Str_db.Execute("insert into SqlIn(Sqlin_IP,SqlIn_Web,SqlIn_FS,SqlIn_CS,SqlIn_SJ) values('"&Request.ServerVariables("REMOTE_ADDR")&"','"&Request.ServerVariables("URL")&"','GET','"&Str_Get&"','"&replace(Request.QueryString(Str_Get),"'","''")&"')") EN^5Hppb  
Str_db.close XkDIP4v%  
Set Str_db = Nothing /V0[Urc@  
'--------写入数据库----------尾----- \I(g 70  
Qu|H_<8g  
Response.Write "<Script Language=JavaScript>alert('请不要在参数中包含非法字符尝试注入！);</Script>" s^#B*
 
Response.Write "非法操作！系统做了如下记录:<br>" s+DOr$\  
Response.Write "操作IP："&Request.ServerVariables("REMOTE_ADDR")&"<br>" vhvFBx0  
Response.Write "操作时间："&Now&"<br>" ?L x*MJZ  
Response.Write "操作页面："&Request.ServerVariables("URL")&"<br>" -%,=%FBi~4  
Response.Write "提交方式：GET<br>" {\hjKP   
Response.Write "提交参数："&Str_Get&"<br>" {OIB/  
Response.Write "提交数据："&Request.QueryString(Str_Get) a]]eQ(xQ  
Response.End Zjd9@  
End If ]l
qLC  
Next 4 Fl>XM  
Next  0~4Ww=#  
End If lha)4d  
%> r'8qZJgm  
第3中方法需要你自己建个数据库表